docs/VALIDATION.md

Validation record

Validated locally on 6 November 2026 using pinned runtime dependencies and Python 3.12.

Completed

• 40 automated tests passed: sample metrics/retrieval, SQLite/CSV ingestion, DOCX/text citations, row caps, rejected writes/multiple statements/dangerous functions/recursive queries, SQL CTEs, URL/private-address blocking, HTML extraction, session/source isolation, reset, consent, CSRF, body-size cap, missing-key behavior, streamed orchestration, document-only mode and remote-host approval.
• PDF extraction smoke check passed: a generated PDF returned text with Page 1 attribution.
• Image OCR smoke check passed: a printed-text PNG returned the expected sentence using local Tesseract.
• Chromium UI smoke check passed: desktop, sample loading, source management, missing-key flow, streamed-answer rendering, five table rows and chart bars, private text upload, and a 390-pixel viewport without horizontal overflow. No browser JavaScript errors.
• JavaScript syntax check passed using node --check static/app.js.

External checks still required

• Live Groq inference was not tested: no API key was provided. Tests explicitly mock provider responses; the shipped application has no canned-answer fallback.
• Remote databases were not supplied. Connector code is included; validate network/TLS/server-version compatibility and read-only privileges with your own reporting database before enabling access.
• Docker build and Hugging Face deployment were not run: Docker is unavailable here and deployment is being handled by you. Pinned Python dependencies installed, the app started, and local API/browser checks passed.
• Public-page parser and URL safety tests passed; individual sites may block fetching or require JavaScript/authentication.
• These checks are not a penetration test, compliance certification or a guarantee of AI factual accuracy.

Repeat

pip install -r requirements-dev.txt
python -m pytest -q
python -m playwright install chromium
python tests/ui_smoke.py

The browser script starts a test server on port 7861, uses an explicit fixture AI stream, and writes screenshots to /tmp/northstar-ui (override UI_ARTIFACTS). It does not call Groq.

After deployment, run the live acceptance questions in DEPLOYMENT.md with your configured key.