docs/TEST_REPORT.md

Validation report - Document Exam Trainer v5.0.3

Validation date: 2026-10-02. Results describe the packaged source in this build environment, not a deployment on Hugging Face and not a completed Docker/OS installation.

Executed

• python -m compileall -q app.py engine desktop scripts deploy_to_hf.py: passed.
• bash -n on the shipped shell scripts: passed.
• DEMO_MODE=1 APP_EDITION=space python -m pytest -q --disable-warnings: 78 passed.
• python scripts/integration_v5.py: both hosted-edition and local-edition HTTP integration checks passed against real Gradio servers with explicitly labelled model fixtures.
• Release ZIP inspection: explicit allowlists, nested Docker download inspected, no runtime account databases, encryption keys, uploads, transcripts, model weights or real user credentials included.

Automated coverage

The inherited tests exercise native PDF/PPTX/DOCX/text parsing, input and archive limits, topic selection, primary/supporting separation, citation validation/alignment, rubric audit, incomplete model output handling, session isolation, expiry, repeated-answer reuse, CPU subprocess contracts, audio validation and browser-bound file access.

New tests exercise local configuration, target Space validation, password hashing and verification, login lockout, token encryption and persistence, per-user preference routing, anonymous calls without an implicit cached token, explicit remote consent, course persistence and ownership, source/index restoration, embedding-model compatibility checks, account/course deletion, history deduplication, recurring-gap observations, API protocol bounds, and release/deployment allowlists. Cached-model settings are restricted to CPU workers so they do not unintentionally disable the remote inference client.

The HTTP integration script uses two real Gradio applications and actual upload, login, cookie, queue and named-API transport. It covers document processing, direct written-answer evaluation, a mocked successful transcription with editable answer text, omissions rendering, course/history persistence, repeated-answer deduplication, account settings, course loading/deletion, targeted practice, cross-user input rejection, download-link configuration and the /trainer_infer_v1 wire protocol. It caught and fixed a ContextVar issue caused by streaming generators resuming in different execution contexts.

The fake speech recognizer and deterministic question/evaluation backend are confined to an explicitly labelled test harness. That harness is NOT uploaded to the Space or included in the downloadable Docker app. The release sets real inference by default; deployment sets DEMO_MODE=0.

Environment

Python 3.13, Gradio 6.5.1, gradio_client 2.0.3, CPU PyTorch 2.10.0, Pydantic 2.13.4 and cryptography 46.0.4. The Dockerfile and Space target Python 3.12, so the target environment must still be checked after deployment. The Compose file was parsed as YAML, but not executed by a Docker daemon.

Not executed here

• Docker image build, Docker Compose startup, named-volume ownership in an actual Docker installation, or image vulnerability scans: Docker was unavailable.
• Windows PowerShell/winget execution, Linux apt/system configuration and actual installer end-to-end operation. PowerShell was unavailable. Only shell syntax and source inspection were possible.
• Real local Qwen inference, real ZeroGPU/Qwen4B/14B inference, or authenticated requests to the target Hugging Face Space.
• Actual MiniLM embeddings, FAISS-specific search, or Whisper/PyAV recognition. Tests use clearly labelled embedding fixtures, the NumPy retrieval fallback and mocked ASR; no neural model weights were downloaded.
• Microphone capture/permissions and visual browser layout. Browser navigation to the local UI was blocked by the environment policy; HTTP testing remained available.
• Educational accuracy, latency/RAM benchmarks, large concurrent classes, production security assessment, licensing clearance, paid subscriptions or payment enforcement.

Do not treat these tests as proof of model quality, a production security audit, a built Docker image, or a successful upload to Hugging Face.

First real deployment checks

1. Deploy with deploy_windows.bat --update or bash deploy_linux.sh --update using a token with write access to AngeloUNIMI/document_exam_trainer. Confirm the existing Space is a Gradio ZeroGPU Space.
2. Open the hosted demo, process a small primary document, record/transcribe an answer, and check a real question/evaluation. Verify the download section retrieves the clean Docker archive.
3. On Windows or Linux, run the downloaded installer. Confirm Docker/Compose, the setup wizard, localhost-only binding, login and volume persistence. Restart and reload a saved course.
4. Configure a personal HF token and remote consent, then complete an oral answer check through the remote API. Confirm the app does not substitute a developer token or silently select another provider.
5. Switch to local CPU mode. Allow model downloads on first use, verify that inference runs in the CPU worker and no Space request occurs. Observe actual RAM and completion times before selecting larger models.
6. Use a second account/browser to verify separation. Check history, delete a course, and exercise account management. Back up all persistent volumes before testing destructive maintenance.