docs/verification.md

Current verification

The dedicated public API is Reubencf/Score-Studio-API, running on ZeroGPU. The updated Next.js frontend is published publicly at https://reubencf-score-studio.hf.space in the Reubencf/Score-Studio CPU Docker Space.

Verified:

• Production build and TypeScript checks pass.
• Bespoke Stencil Bold headings and Supreme Regular body text render in the browser.
• Light and dark themes cover the entire page; an expanding theme wave was visually checked.
• Processing chooses one random musician and shows the back button immediately under its label.
• Anonymous, expired and tampered sessions are rejected before importing or processing audio.
• Cross-origin submissions and invalid OAuth callback state are rejected.
• Session responses expose only the public user profile; sign-out clears the session cookie.
• Hugging Face accepts the public OAuth metadata and directs the browser to its login screen.
• The supplied YouTube video u10U7BHQQ2Y imports completely, with title, thumbnail and 274.58 seconds of audio.
• Imported audio is normalized to mono 24 kHz and protected by the importing account's session.
• A controlled authenticated HTTP integration test sent the full song through Next.js to ZeroGPU. The backend completed inference/rendering in 34 seconds and returned 5,584 characters of ABC, 11 score pages, MIDI files, PDF, piano audio and a ZIP. Downloaded PDF and WAV headers were checked. This test used the locally authorized HF token; it does not substitute for testing a visitor's OAuth session.

Hosted deployment checks:

• Docker build passed after using the Node base image's existing UID 1000 user.
• Hugging Face reports RUNNING for frontend commit 50b572405dadcf1f0a467c26c697e7d97e892084.
• Homepage, public session response and both font assets return HTTP 200.
• The development animation preview returns HTTP 404 in production.
• Signed-out import/transcription requests return HTTP 401.
• Hosted login sets a Secure HttpOnly cookie and sends the correct production callback and PKCE challenge to Hugging Face, which accepts the authorization request.

Remaining end-to-end checks:

• The user must finish Hugging Face login in the browser so the real OAuth callback, account quota and signed-in browser flow can be verified.
• Check YouTube access from the hosted frontend with a real signed-in session.

The original Reubencf/Audio-to-Score Space was not modified by this update.