| # Validation record |
|
|
| Validated locally on 6 November 2026 using pinned runtime dependencies and Python 3.12. |
|
|
| ## Completed |
|
|
| - **40 automated tests passed**: sample metrics/retrieval, SQLite/CSV ingestion, DOCX/text citations, row caps, rejected writes/multiple statements/dangerous functions/recursive queries, SQL CTEs, URL/private-address blocking, HTML extraction, session/source isolation, reset, consent, CSRF, body-size cap, missing-key behavior, streamed orchestration, document-only mode and remote-host approval. |
| - **PDF extraction smoke check passed**: a generated PDF returned text with Page 1 attribution. |
| - **Image OCR smoke check passed**: a printed-text PNG returned the expected sentence using local Tesseract. |
| - **Chromium UI smoke check passed**: desktop, sample loading, source management, missing-key flow, streamed-answer rendering, five table rows and chart bars, private text upload, and a 390-pixel viewport without horizontal overflow. No browser JavaScript errors. |
| - **JavaScript syntax check passed** using `node --check static/app.js`. |
|
|
| ## External checks still required |
|
|
| - **Live Groq inference was not tested:** no API key was provided. Tests explicitly mock provider responses; the shipped application has no canned-answer fallback. |
| - **Remote databases were not supplied.** Connector code is included; validate network/TLS/server-version compatibility and read-only privileges with your own reporting database before enabling access. |
| - **Docker build and Hugging Face deployment were not run:** Docker is unavailable here and deployment is being handled by you. Pinned Python dependencies installed, the app started, and local API/browser checks passed. |
| - Public-page parser and URL safety tests passed; individual sites may block fetching or require JavaScript/authentication. |
| - These checks are not a penetration test, compliance certification or a guarantee of AI factual accuracy. |
|
|
| ## Repeat |
|
|
| ```bash |
| pip install -r requirements-dev.txt |
| python -m pytest -q |
| python -m playwright install chromium |
| python tests/ui_smoke.py |
| ``` |
|
|
| The browser script starts a test server on port 7861, uses an explicit fixture AI stream, and writes screenshots to `/tmp/northstar-ui` (override `UI_ARTIFACTS`). It does not call Groq. |
|
|
| After deployment, run the live acceptance questions in `DEPLOYMENT.md` with your configured key. |
|
|
