Harden demo requests

app.py

@@ -15,13 +15,14 @@ Typical usage example:
   python app.py
 """
 
+import hashlib
+import json
 import logging
 import os
+from pathlib import Path
 import shutil
 import tempfile
 import time
-import json
-import hashlib
 
 from flask import Flask, jsonify, render_template, request
 from flask_limiter import Limiter
@@ -32,13 +33,19 @@ from sanitize import preprocess_report
 from social_sharing import SocialSharingConfig
 from structure_report import (
     DEFAULT_MODEL_ID,
+    LEGACY_MODEL_ALIASES,
     RadiologyReportStructurer,
+    ReportProcessingError,
     ResponseDict,
     resolve_model_id,
 )
 
 # Configuration constants
 MAX_INPUT_LENGTH = 3000
+_PUBLIC_MODEL_IDS = frozenset({DEFAULT_MODEL_ID, *LEGACY_MODEL_ALIASES.values()})
+_SAMPLE_REPORTS_PATH = (
+    Path(__file__).resolve().parent / "static" / "sample_reports.json"
+)
 
 logging.basicConfig(
     level=logging.INFO, format="%(asctime)s [%(levelname)s] %(message)s"
@@ -46,6 +53,31 @@ logging.basicConfig(
 logger = logging.getLogger(__name__)
 
 
+def _load_sample_catalog() -> dict[str, str]:
+    """Loads normalized sample reports keyed by their public sample ID."""
+    sample_data = json.loads(_SAMPLE_REPORTS_PATH.read_text(encoding="utf-8"))
+    return {
+        sample["id"]: preprocess_report(sample["text"])
+        for sample in sample_data["samples"]
+    }
+
+
+_SAMPLE_CATALOG = _load_sample_catalog()
+
+
+def _allowed_request_models() -> frozenset[str]:
+    """Returns model IDs that callers may select through the public API."""
+    configured_model = resolve_model_id(os.environ.get("MODEL_ID", DEFAULT_MODEL_ID))
+    return _PUBLIC_MODEL_IDS | {configured_model}
+
+
+def _verified_sample_id(sample_id: str | None, report_text: str) -> str | None:
+    """Returns a sample ID only when its normalized catalog text matches."""
+    if sample_id and _SAMPLE_CATALOG.get(sample_id) == report_text:
+        return sample_id
+    return None
+
+
 class Model:
     """Manages RadiologyReportStructurer instances for different Gemini model IDs.
 
@@ -110,10 +142,10 @@ class Model:
         Returns:
             Dictionary containing the structured prediction results.
         """
-        logger.info(f"Processing prediction with model: {model_id}")
+        logger.info("Processing prediction with model: %s", model_id)
         structurer = self._get_structurer(model_id)
         result = structurer.predict(data)
-        logger.info(f"Result preview: {str(result)[:500]}...")
+        logger.info("Prediction completed with model: %s", structurer.model_id)
         return result
 
 
@@ -227,7 +259,11 @@ def predict():
                 jsonify(
                     {
                         "error": "Input too long",
-                        "message": f"Input length ({len(data)} characters) exceeds maximum allowed length of {MAX_INPUT_LENGTH} characters",
+                        "message": (
+                            f"Input length ({len(data)} characters) exceeds "
+                            "maximum allowed length of "
+                            f"{MAX_INPUT_LENGTH} characters"
+                        ),
                         "max_length": MAX_INPUT_LENGTH,
                     }
                 ),
@@ -235,22 +271,38 @@ def predict():
             )
 
         use_cache = request.headers.get("X-Use-Cache", "true").lower() == "true"
-        sample_id = request.headers.get("X-Sample-ID")
+        requested_sample_id = request.headers.get("X-Sample-ID")
         model_id = resolve_model_id(
             request.headers.get(
                 "X-Model-ID", os.environ.get("MODEL_ID", DEFAULT_MODEL_ID)
             )
         )
+        if model_id not in _allowed_request_models():
+            return (
+                jsonify(
+                    {
+                        "error": "Unsupported model",
+                        "message": (
+                            "The requested model is not available in this demo."
+                        ),
+                    }
+                ),
+                400,
+            )
+
         processed_data = preprocess_report(data)
+        sample_id = _verified_sample_id(requested_sample_id, processed_data)
 
-        if use_cache:
+        if use_cache and sample_id:
             cached_result = cache_manager.get_cached_result(processed_data, sample_id)
             if cached_result:
                 req_id = hashlib.md5(
                     f"{request.remote_addr}{int(time.time()/3600)}".encode()
                 ).hexdigest()[:8]
                 logger.info(
-                    f"🟢 CACHE HIT [Req {req_id}] [Worker {os.getpid()}] - Returning cached result (no API call)"
+                    "CACHE HIT [Req %s] [Worker %s] - Returning prebuilt result",
+                    req_id,
+                    os.getpid(),
                 )
                 return jsonify({"from_cache": True, **cached_result})
 
@@ -259,30 +311,58 @@ def predict():
                 f"{request.remote_addr}{int(time.time()/3600)}".encode()
             ).hexdigest()[:8]
             logger.info(
-                f"��� API CALL [Req {req_id}] [Worker {os.getpid()}] - Processing with Gemini model: {model_id}"
+                "API CALL [Req %s] [Worker %s] - Processing with model %s",
+                req_id,
+                os.getpid(),
+                model_id,
             )
             result = model.predict(processed_data, model_id=model_id)
-
-            # Cache if it's a predefined sample
-            if use_cache and sample_id:
-                cache_manager.cache_result(processed_data, result, sample_id)
-
             result["sanitized_input"] = processed_data
 
+            logger.info(
+                "Prediction succeeded [Req %s] [Worker %s] with model %s in %.2fs",
+                req_id,
+                os.getpid(),
+                model_id,
+                time.time() - start_time,
+            )
+
             return jsonify(result)
 
-        except TypeError as te:
-            error_msg = str(te)
-            logger.error(f"TypeError in prediction: {error_msg}", exc_info=True)
+        except ReportProcessingError as error:
+            cause_type = (
+                type(error.__cause__).__name__
+                if error.__cause__ is not None
+                else type(error).__name__
+            )
+            logger.error("Prediction provider failure: %s", cause_type)
 
             return (
-                jsonify({"error": "Processing error. Please try a different input."}),
-                500,
+                jsonify(
+                    {
+                        "error": "Processing unavailable",
+                        "message": (
+                            "The report could not be processed right now. "
+                            "Please try again later."
+                        ),
+                    }
+                ),
+                502,
             )
-    except Exception as e:
-        logger.error(f"Prediction error: {str(e)}", exc_info=True)
-
-        return jsonify({"error": str(e)}), 500
+    except Exception as error:
+        logger.error("Prediction failure: %s", type(error).__name__)
+
+        return (
+            jsonify(
+                {
+                    "error": "Internal processing error",
+                    "message": (
+                        "The request could not be completed. Please try again later."
+                    ),
+                }
+            ),
+            500,
+        )
 
 
 @app.errorhandler(429)

pyproject.toml

@@ -30,7 +30,7 @@ dependencies = [
     "Flask>=3.1.0",
     "Flask-Limiter>=3.5.0",
     "gunicorn>=23.0.0",
-    "langextract>=0.1.3",
+    "langextract>=1.6.0,<2.0.0",
     "pandas>=1.3.0",
     "numpy>=1.20.0",
     "ml-collections>=0.1.0",
@@ -81,5 +81,5 @@ disable = [
 ]
 
 [tool.pytest.ini_options]
-testpaths = ["tests"]
-python_files = ["test_*.py", "*_test.py"] 
+testpaths = ["test_app.py", "test_validation.py"]
+python_files = ["test_*.py", "*_test.py"]

static/script.js

@@ -569,8 +569,11 @@ document.addEventListener('DOMContentLoaded', function () {
             // Check if JSONFormatter is available
             if (typeof window.JSONFormatter === 'undefined') {
               console.error('JSONFormatter library not loaded, using fallback');
-              rawOutput.innerHTML = '<pre style="white-space: pre-wrap; word-wrap: break-word;">' + 
-                                   JSON.stringify(rawData, null, 2) + '</pre>';
+              const pre = document.createElement('pre');
+              pre.style.whiteSpace = 'pre-wrap';
+              pre.style.wordWrap = 'break-word';
+              pre.textContent = JSON.stringify(rawData, null, 2);
+              rawOutput.replaceChildren(pre);
               rawOutput._jsonData = rawData;
               return;
             }
@@ -616,9 +619,15 @@ document.addEventListener('DOMContentLoaded', function () {
 
           if (promptOutput) {
             const promptText = data.raw_prompt || 'Prompt data not available.';
-            if (typeof marked !== 'undefined' && data.raw_prompt) {
+            if (
+              typeof marked !== 'undefined' &&
+              typeof DOMPurify !== 'undefined' &&
+              data.raw_prompt
+            ) {
               // Render markdown with syntax highlighting support
-              promptOutput.innerHTML = marked.parse(promptText);
+              promptOutput.innerHTML = DOMPurify.sanitize(
+                marked.parse(promptText),
+              );
             } else {
               // Fallback to plain text
               promptOutput.textContent = promptText;

structure_report.py

@@ -24,7 +24,6 @@ import collections
 import dataclasses
 import itertools
 from enum import Enum
-from functools import wraps
 from typing import Any, TypedDict
 
 import langextract as lx
@@ -47,6 +46,10 @@ def resolve_model_id(model_id: str) -> str:
     return LEGACY_MODEL_ALIASES.get(model_id, model_id)
 
 
+class ReportProcessingError(RuntimeError):
+    """Raised when the language-model extraction step cannot complete."""
+
+
 class FrontendIntervalDict(TypedDict):
     """Character interval for frontend with startPos and endPos."""
 
@@ -101,29 +104,6 @@ SIGNIFICANCE_SIGNIFICANT = "significant"
 SIGNIFICANCE_NOT_APPLICABLE = "not_applicable"
 
 
-def _initialize_langextract_patches():
-    """Initialize LangExtract patches for proper alignment behavior.
-
-    This function applies necessary patches to LangExtract's Resolver.align method to force accept_match_lesser=False and set fuzzy_alignment_threshold to 0.50. This should be called before using LangExtract functionality.
-
-    Note: This is a temporary workaround until LangExtract exposes
-    accept_match_lesser and fuzzy_alignment_threshold parameters via its public API.
-    """
-    # Store original method
-    original_align = lx.resolver.Resolver.align
-
-    @wraps(original_align)
-    def _align_patched(self, *args, **kwargs):
-        # Set default if not explicitly provided
-        kwargs.setdefault("accept_match_lesser", False)
-        # Set fuzzy matching threshold to 0.50
-        kwargs.setdefault("fuzzy_alignment_threshold", 0.50)
-        return original_align(self, *args, **kwargs)
-
-    # Apply the patch
-    lx.resolver.Resolver.align = _align_patched
-
-
 class ReportSectionType(Enum):
     """Enum representing sections of a radiology report with their extraction class names."""
 
@@ -182,7 +162,6 @@ class RadiologyReportStructurer:
     model_id: str
     temperature: float
     examples: list[langextract.data.ExampleData]
-    _patches_initialized: bool
 
     def __init__(
         self,
@@ -201,13 +180,6 @@ class RadiologyReportStructurer:
         self.model_id = resolve_model_id(model_id)
         self.temperature = temperature
         self.examples = report_examples.get_examples_for_model()
-        self._patches_initialized = False
-
-    def _ensure_patches_initialized(self):
-        """Ensure LangExtract patches are initialized before use."""
-        if not self._patches_initialized:
-            _initialize_langextract_patches()
-            self._patches_initialized = True
 
     def _generate_formatted_prompt_with_examples(
         self, input_text: str | None = None
@@ -247,14 +219,9 @@ class RadiologyReportStructurer:
 
         try:
             result = self._perform_langextract(report_text, max_char_buffer)
-            return self._build_response(result, report_text)
-        except (ValueError, TypeError, AttributeError) as e:
-            return ResponseDict(
-                text=f"Error processing report: {str(e)}",
-                segments=[],
-                annotated_document_json={},
-                raw_prompt="",
-            )
+        except Exception as error:
+            raise ReportProcessingError("Report processing failed") from error
+        return self._build_response(result, report_text)
 
     def _perform_langextract(
         self, report_text: str, max_char_buffer: int
@@ -272,7 +239,6 @@ class RadiologyReportStructurer:
             ValueError: If LangExtract processing fails.
             TypeError: If invalid parameters are provided.
         """
-        self._ensure_patches_initialized()
         return lx.extract(
             text_or_documents=report_text,
             prompt_description=prompt_instruction.PROMPT_INSTRUCTION.split(
@@ -283,8 +249,10 @@ class RadiologyReportStructurer:
             api_key=self.api_key,
             max_char_buffer=max_char_buffer,
             temperature=self.temperature,
-            # accept_match_lesser handled via monkey-patch
-            # (Resolver.align patched at import time)
+            resolver_params={
+                "accept_match_lesser": False,
+                "fuzzy_alignment_threshold": 0.50,
+            },
         )
 
     def _build_response(

templates/index.html

@@ -479,6 +479,11 @@
 
     <script src="https://cdn.jsdelivr.net/npm/json-formatter-js@2.3.4/dist/json-formatter.umd.js"></script>
     <script src="https://cdn.jsdelivr.net/npm/marked@9.1.6/marked.min.js"></script>
+    <script
+      src="https://cdn.jsdelivr.net/npm/dompurify@3.4.12/dist/purify.min.js"
+      integrity="sha384-piCcpDdJ7qVeK4Tv8Z6Hpcr3ZBIgP16TxQTPVfsLFdZ5uDgwc3Y8Ho7oUnqf12qu"
+      crossorigin="anonymous"
+    ></script>
 
     <script src="https://cdnjs.cloudflare.com/ajax/libs/gsap/3.12.2/gsap.min.js"></script>
     <script

test_app.py

@@ -8,15 +8,20 @@ Run with: python test_app.py or pytest test_app.py
 
 import json
 import os
+from pathlib import Path
 import tempfile
 import unittest
 from unittest import mock
 
 # Mock the environment before importing app to avoid initialization errors
 with mock.patch.dict(os.environ, {'KEY': 'test_api_key_for_import'}):
+    import app as app_module
     from app import Model, app, setup_cache
 
 
+_SENSITIVE_REPORT_TEXT = 'PRIVATE PATIENT FINDING'
+
+
 class TestFlaskApplication(unittest.TestCase):
 
     @classmethod
@@ -82,6 +87,8 @@ class TestFlaskApplication(unittest.TestCase):
 
     @mock.patch('app.cache_manager.get_cached_result')
     def test_predict_with_cache_hit(self, mock_get_cached):
+        sample_data = json.loads(Path('static/sample_reports.json').read_text())
+        sample = sample_data['samples'][0]
         cached_response = {
             'segments': [{'type': 'body', 'content': 'cached'}],
             'text': 'cached result',
@@ -89,13 +96,214 @@ class TestFlaskApplication(unittest.TestCase):
         mock_get_cached.return_value = cached_response
 
         response = self.test_client.post(
-            '/predict', data='Test report', headers={'X-Use-Cache': 'true'}
+            '/predict',
+            data=sample['text'],
+            headers={
+                'X-Use-Cache': 'true',
+                'X-Sample-ID': sample['id'],
+            },
         )
 
         data = json.loads(response.data)
         self.assertTrue(data.get('from_cache'))
         self.assertIn('segments', data)
 
+    def test_matching_catalog_sample_uses_prebuilt_cache(self):
+        sample_data = json.loads(Path('static/sample_reports.json').read_text())
+        sample = sample_data['samples'][0]
+        cached_response = {'segments': [], 'text': 'cached result'}
+
+        with (
+            mock.patch.object(
+                app_module.cache_manager,
+                'get_cached_result',
+                autospec=True,
+                return_value=cached_response,
+            ) as mock_get_cached,
+            mock.patch.object(
+                app_module.model, 'predict', autospec=True
+            ) as mock_predict,
+        ):
+            response = self.test_client.post(
+                '/predict',
+                data=sample['text'],
+                headers={
+                    'X-Use-Cache': 'true',
+                    'X-Sample-ID': sample['id'],
+                },
+            )
+
+        self.assertEqual(response.status_code, 200)
+        self.assertTrue(response.get_json()['from_cache'])
+        mock_get_cached.assert_called_once()
+        mock_predict.assert_not_called()
+
+    def test_mismatched_catalog_sample_bypasses_cache(self):
+        cached_response = {'segments': [], 'text': 'wrong cached result'}
+        live_response = {'segments': [], 'text': 'live result'}
+
+        with (
+            mock.patch.object(
+                app_module.cache_manager,
+                'get_cached_result',
+                autospec=True,
+                return_value=cached_response,
+            ) as mock_get_cached,
+            mock.patch.object(
+                app_module.cache_manager, 'cache_result', autospec=True
+            ) as mock_cache_result,
+            mock.patch.object(
+                app_module.model,
+                'predict',
+                autospec=True,
+                return_value=live_response,
+            ) as mock_predict,
+        ):
+            response = self.test_client.post(
+                '/predict',
+                data='EXAMINATION: A report that is not the chest sample.',
+                headers={
+                    'X-Use-Cache': 'true',
+                    'X-Sample-ID': 'chest_xray',
+                },
+            )
+
+        self.assertEqual(response.status_code, 200)
+        self.assertFalse(response.get_json().get('from_cache', False))
+        mock_get_cached.assert_not_called()
+        mock_predict.assert_called_once()
+        mock_cache_result.assert_not_called()
+
+    def test_unknown_sample_id_is_never_cached(self):
+        live_response = {'segments': [], 'text': 'live result'}
+
+        with (
+            mock.patch.object(
+                app_module.cache_manager,
+                'get_cached_result',
+                autospec=True,
+            ) as mock_get_cached,
+            mock.patch.object(
+                app_module.cache_manager, 'cache_result', autospec=True
+            ) as mock_cache_result,
+            mock.patch.object(
+                app_module.model,
+                'predict',
+                autospec=True,
+                return_value=live_response,
+            ),
+        ):
+            response = self.test_client.post(
+                '/predict',
+                data='EXAMINATION: Unknown sample.',
+                headers={
+                    'X-Use-Cache': 'true',
+                    'X-Sample-ID': 'not_in_catalog',
+                },
+            )
+
+        self.assertEqual(response.status_code, 200)
+        mock_get_cached.assert_not_called()
+        mock_cache_result.assert_not_called()
+
+    def test_catalog_cache_miss_is_not_written_at_runtime(self):
+        sample_data = json.loads(Path('static/sample_reports.json').read_text())
+        sample = sample_data['samples'][0]
+        live_response = {'segments': [], 'text': 'live result'}
+
+        with (
+            mock.patch.object(
+                app_module.cache_manager,
+                'get_cached_result',
+                autospec=True,
+                return_value=None,
+            ),
+            mock.patch.object(
+                app_module.cache_manager, 'cache_result', autospec=True
+            ) as mock_cache_result,
+            mock.patch.object(
+                app_module.model,
+                'predict',
+                autospec=True,
+                return_value=live_response,
+            ),
+        ):
+            response = self.test_client.post(
+                '/predict',
+                data=sample['text'],
+                headers={
+                    'X-Use-Cache': 'true',
+                    'X-Sample-ID': sample['id'],
+                },
+            )
+
+        self.assertEqual(response.status_code, 200)
+        mock_cache_result.assert_not_called()
+
+    def test_unapproved_model_returns_stable_client_error(self):
+        with mock.patch.object(
+            app_module.model,
+            'predict',
+            autospec=True,
+            return_value={'segments': [], 'text': 'result'},
+        ) as mock_predict:
+            response = self.test_client.post(
+                '/predict',
+                data='FINDINGS: Normal chest.',
+                headers={
+                    'X-Use-Cache': 'false',
+                    'X-Model-ID': 'unapproved-model',
+                },
+            )
+
+        self.assertEqual(response.status_code, 400)
+        self.assertEqual(response.get_json()['error'], 'Unsupported model')
+        self.assertIn('message', response.get_json())
+        mock_predict.assert_not_called()
+
+    @mock.patch.dict(os.environ, {'MODEL_ID': 'configured-current-model'})
+    def test_environment_configured_model_is_allowed(self):
+        with mock.patch.object(
+            app_module.model,
+            'predict',
+            autospec=True,
+            return_value={'segments': [], 'text': 'result'},
+        ) as mock_predict:
+            response = self.test_client.post(
+                '/predict',
+                data='FINDINGS: Normal chest.',
+                headers={
+                    'X-Use-Cache': 'false',
+                    'X-Model-ID': 'configured-current-model',
+                },
+            )
+
+        self.assertEqual(response.status_code, 200)
+        mock_predict.assert_called_once_with(
+            'FINDINGS: Normal chest.', model_id='configured-current-model'
+        )
+
+    def test_legacy_pro_model_resolves_at_http_boundary(self):
+        with mock.patch.object(
+            app_module.model,
+            'predict',
+            autospec=True,
+            return_value={'segments': [], 'text': 'result'},
+        ) as mock_predict:
+            response = self.test_client.post(
+                '/predict',
+                data='FINDINGS: Normal chest.',
+                headers={
+                    'X-Use-Cache': 'false',
+                    'X-Model-ID': 'gemini-2.5-pro',
+                },
+            )
+
+        self.assertEqual(response.status_code, 200)
+        mock_predict.assert_called_once_with(
+            'FINDINGS: Normal chest.', model_id='gemini-pro-latest'
+        )
+
 
 class TestModelClass(unittest.TestCase):
 
@@ -138,6 +346,19 @@ class TestModelClass(unittest.TestCase):
         mock_instance.predict.assert_called_once_with('test data')
         self.assertEqual(result, {'result': 'test'})
 
+    @mock.patch.dict(os.environ, {'KEY': 'test_key'})
+    @mock.patch('app.RadiologyReportStructurer')
+    def test_predict_does_not_log_report_content(self, mock_structurer_class):
+        mock_instance = mock.Mock()
+        mock_instance.predict.return_value = {'text': _SENSITIVE_REPORT_TEXT}
+        mock_structurer_class.return_value = mock_instance
+        model = Model()
+
+        with mock.patch.object(app_module.logger, 'info', autospec=True) as log:
+            model.predict(_SENSITIVE_REPORT_TEXT, 'gemini-flash-latest')
+
+        self.assertNotIn(_SENSITIVE_REPORT_TEXT, str(log.call_args_list))
+
 
 class TestCacheSetup(unittest.TestCase):
 
@@ -199,18 +420,71 @@ class TestErrorHandling(unittest.TestCase):
         self.assertEqual(response.status_code, 500)
 
         data = json.loads(response.data)
-        self.assertIn('Processing error', data['error'])
+        self.assertEqual(data['error'], 'Internal processing error')
+        self.assertIn('message', data)
+
+    @mock.patch('app.model.predict')
+    @mock.patch('app.logger')
+    def test_predict_handles_provider_error(self, mock_logger, mock_predict):
+        provider_error = RuntimeError(_SENSITIVE_REPORT_TEXT)
+        processing_error = app_module.ReportProcessingError('Report processing failed')
+        processing_error.__cause__ = provider_error
+        mock_predict.side_effect = processing_error
+
+        response = self.test_client.post('/predict', data='Test data')
+
+        self.assertEqual(response.status_code, 502)
+        data = response.get_json()
+        self.assertEqual(data['error'], 'Processing unavailable')
+        self.assertIn('message', data)
+        self.assertNotIn(_SENSITIVE_REPORT_TEXT, response.get_data(as_text=True))
+        self.assertNotIn(_SENSITIVE_REPORT_TEXT, str(mock_logger.method_calls))
 
     @mock.patch('app.model.predict')
     @mock.patch('app.logger')
     def test_predict_handles_general_exception(self, mock_logger, mock_predict):
-        mock_predict.side_effect = Exception('General error')
+        mock_predict.side_effect = Exception(_SENSITIVE_REPORT_TEXT)
 
         response = self.test_client.post('/predict', data='Test data')
         self.assertEqual(response.status_code, 500)
 
         data = json.loads(response.data)
-        self.assertIn('General error', data['error'])
+        self.assertEqual(data['error'], 'Internal processing error')
+        self.assertIn('message', data)
+        self.assertNotIn(_SENSITIVE_REPORT_TEXT, response.get_data(as_text=True))
+        self.assertNotIn(_SENSITIVE_REPORT_TEXT, str(mock_logger.method_calls))
+
+
+class TestFrontendAndProjectConfiguration(unittest.TestCase):
+
+    def test_frontend_sanitizes_prompt_and_raw_fallback(self):
+        script = Path('static/script.js').read_text()
+        template = Path('templates/index.html').read_text()
+
+        self.assertIn('DOMPurify.sanitize', script)
+        self.assertIn('dompurify', template.lower())
+        self.assertIn('pre.textContent', script)
+        self.assertNotIn("rawOutput.innerHTML = '<pre", script)
+
+    def test_langextract_floor_supports_resolver_params(self):
+        project = Path('pyproject.toml').read_text()
+
+        self.assertIn('"langextract>=1.6.0,<2.0.0"', project)
+
+    def test_sample_preprocessing_is_idempotent_and_cache_is_complete(self):
+        samples = json.loads(Path('static/sample_reports.json').read_text())['samples']
+        cache = json.loads(Path('cache/sample_cache.json').read_text())
+
+        for sample in samples:
+            with self.subTest(sample=sample['id']):
+                normalized = app_module.preprocess_report(sample['text'])
+                self.assertEqual(app_module.preprocess_report(normalized), normalized)
+                self.assertIn(f"sample_{sample['id']}", cache)
+
+    def test_pytest_discovers_root_test_files_without_fallback(self):
+        project = Path('pyproject.toml').read_text()
+
+        self.assertIn('testpaths = ["test_app.py", "test_validation.py"]', project)
 
 
 if __name__ == '__main__':

test_validation.py

@@ -22,12 +22,17 @@ import unittest
 from typing import Any
 from unittest import mock
 
+import langextract as lx
+
 # Add the current directory to path for imports
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 
 from structure_report import RadiologyReportStructurer
 
 
+_ORIGINAL_RESOLVER_ALIGN = lx.resolver.Resolver.align
+
+
 class TestRadiologyReportEndToEnd(unittest.TestCase):
     """End-to-end tests for complete RadiologyReportStructurer pipeline."""
 
@@ -96,6 +101,13 @@ class TestRadiologyReportEndToEnd(unittest.TestCase):
         call_args = mock_extract.call_args
         self.assertEqual(call_args[1]['text_or_documents'], input_text)
         self.assertEqual(call_args[1]['model_id'], 'gemini-flash-latest')
+        self.assertEqual(
+            call_args[1]['resolver_params'],
+            {
+                'accept_match_lesser': False,
+                'fuzzy_alignment_threshold': 0.50,
+            },
+        )
 
     def test_legacy_pro_model_resolves_to_rolling_alias(self):
         structurer = RadiologyReportStructurer(
@@ -129,19 +141,54 @@ class TestRadiologyReportEndToEnd(unittest.TestCase):
     def test_error_handling_with_no_api_key(self):
         error_structurer = RadiologyReportStructurer(api_key=None)
 
-        response = error_structurer.predict('EXAMINATION: Test')
+        with mock.patch.object(
+            lx,
+            'extract',
+            autospec=True,
+            side_effect=RuntimeError('sensitive provider detail'),
+        ):
+            with self.assertRaisesRegex(RuntimeError, 'Report processing failed'):
+                error_structurer.predict('EXAMINATION: Test')
 
-        self._validate_response_structure(response)
-        self.assertEqual(len(response['segments']), 0)
-        self.assertIn('Error processing report', response['text'])
-
-    def test_patch_initialization_on_first_use(self):
+    def test_predict_does_not_patch_global_resolver(self):
         new_structurer = RadiologyReportStructurer()
 
-        self.assertFalse(new_structurer._patches_initialized)
+        with mock.patch.object(lx, 'extract', autospec=True) as mock_extract:
+            mock_result = mock.MagicMock()
+            mock_result.extractions = []
+            mock_extract.return_value = mock_result
+            new_structurer.predict('EXAMINATION: Test')
+
+        self.assertIs(lx.resolver.Resolver.align, _ORIGINAL_RESOLVER_ALIGN)
+
+    def test_resolver_settings_reject_partial_exact_matches(self):
+        source_text = 'No acute disease.'
+        extraction_text = 'No acute disease absent invented words words words words.'
+
+        accepted = list(
+            lx.resolver.Resolver().align(
+                [lx.data.Extraction('finding', extraction_text)],
+                source_text,
+                token_offset=0,
+                accept_match_lesser=True,
+                fuzzy_alignment_threshold=0.50,
+            )
+        )
+        rejected = list(
+            lx.resolver.Resolver().align(
+                [lx.data.Extraction('finding', extraction_text)],
+                source_text,
+                token_offset=0,
+                accept_match_lesser=False,
+                fuzzy_alignment_threshold=0.50,
+            )
+        )
 
-        new_structurer._ensure_patches_initialized()
-        self.assertTrue(new_structurer._patches_initialized)
+        self.assertEqual(
+            accepted[0].alignment_status, lx.data.AlignmentStatus.MATCH_LESSER
+        )
+        self.assertIsNone(rejected[0].alignment_status)
+        self.assertIsNone(rejected[0].char_interval)
 
     def test_section_mapping_core_functionality(self):
         self.assertEqual(