DOCX Formula Runtime Determinism Proof

Scope

SVC-013 remains an external runtime-adapter boundary. This proof calls the read-only Go Formula runtime through POST /v1/import/docx/qas; it does not create services/formula-docx-service, modify legacy source, write a database, or promote a Gateway route.

The proof repeats each corpus fixture twice and compares a SHA-256 fingerprint of canonical import-visible output. The canonical payload deliberately excludes runtime latency while retaining parser versions, question content, answer and solution fields, display-media metadata, formula source/provenance, LaTeX, MathML, OMML hashes, MTEF/OLE IDs, warnings, and parser metadata. It follows the adapter's display-media filter: raw OLE and WMF/EMF preview assets are not browser media and are excluded before import-service review persistence.

Runtime Command

DOCX_FORMULA_DETERMINISM_CONFIRM=read-only-formula-runtime \
GO_FORMULA_DOCX_URL=http://127.0.0.1:8095 \
HOCTAPAZ_DOCX_CORPUS_DIR=/Users/velikho/Desktop/test-hoctapaz \
make test-docx-formula-determinism

The command requires the external runtime directory runtimes/go-formula-docx and fails if a deployable services/formula-docx-service directory exists. Artifacts are written below output/qa/docx-formula-determinism-runtime-<timestamp>/.

Assertions

• Math fixture: 22 questions and 125 formulas, with 117 mtef-ole and 8 omml sources.
• Physics fixture: 28 questions and 84 mtef-ole formulas.
• Every formula is marked deterministic and contains non-empty LaTeX and MathML.
• The two canonical response fingerprints for each fixture must be identical; only result.latency.totalMs is recorded separately as a latency observation.
• The same two calls are also mapped by the real Go docx-import-service adapter. After its latency_ms is cleared, json.Marshal of the complete import-visible response must be byte-identical.

Latest Local Evidence (2026-07-15)

output/qa/docx-formula-determinism-runtime-20260715-current/summary.json records a fresh two-call recheck per fixture against the local external runtime published at http://127.0.0.1:8095:

• Math: 22 questions, 125 deterministic LaTeX/MathML formulas, 117 mtef-ole plus 8 omml, fingerprint cae23f6583080f5c6e1f41abf2664fbf1690dcc4b2d7c8ca45ceae5e6d6c91d7, and runtime observations of 71 ms and 67 ms.
• Physics: 28 questions, 84 deterministic LaTeX/MathML mtef-ole formulas, fingerprint 11b1bd26d1a8ee2d5501f95c66a4e3a7670778e4ef8a9e5e4440c1467282f892, and runtime observations of 72 ms and 71 ms.
• TestGoFormulaCorpusImportVisibleDeterminism then called the real Go adapter twice for each fixture and passed its byte-identical comparison after clearing latency_ms.

After the local host default was aligned to the Compose-published :8095 runtime, output/qa/docx-formula-determinism-runtime-20260714190949081/ repeated the same current-runtime proof without a URL override. It retained the same Math and Physics fingerprints, with two-call runtime observations of 80/87 ms and 74/74 ms respectively; the Go adapter comparison passed again.

A raw QAS response can vary in a non-display OLE/WMF asset's packagePath while retaining the same asset ID. That field is deliberately filtered by mapGoFormulaQASImages before review or Question Bank persistence. This proof therefore demonstrates deterministic import-visible behavior, not byte-level identity of every raw runtime diagnostic asset.

Current Recheck (2026-07-15)

DOCX_FORMULA_DETERMINISM_CONFIRM=read-only-formula-runtime make test-docx-formula-determinism passed again against the local :8095 runtime. Artifact output/qa/docx-formula-determinism-runtime-20260715011233246/ records Math at 22 questions and 125 formulas (117 MTEF-OLE plus 8 OMML) with 71/62 ms runtime observations, and Physics at 28 questions and 84 MTEF-OLE formulas with 67/67 ms observations. Both import-visible fingerprints matched across two runtime calls, and the real Go adapter's byte-identical comparison passed after clearing the observational latency_ms field.

Boundary And Rollback

This is local, read-only runtime evidence only. It does not prove default Gateway routing, frontend direct access, deployed runtime parity, provider OCR quality, or production promotion. Rollback is to retain the existing docx-import-service fallback and internal runtime wiring; any runtime source change requires a separate approved task in the legacy workspace.