DOCX Physics Gateway Attempt Proof

This is a composite non-default rehearsal for the real Physics DOCX fixture. It preserves deploy/gateway/routes.json and uses only the candidate tables:

• deploy/gateway/routes.docx-physics-attempt-native-example.json for Compose
• deploy/gateway/routes.docx-physics-attempt-native-localhost-example.json for local service ports

The bounded route set covers owner-scoped source upload, DOCX Fast creation, job-status reads, and approval, Question Bank list and owner-scoped detail evidence reads, BFF matrix generation, exam publish, durable Word export creation/list/content, and the student start/save/submit/result path. Unrelated import, teacher, exam, and attempt routes remain legacy proxies.

Static Guard

make test-docx-physics-attempt-routes
DOCX_PHYSICS_GATEWAY_ATTEMPT_SELF_TEST=1 \
  make test-docx-physics-attempt-live

The self-test parses both candidate tables and verifies that the harness scope is limited to the required routes. It does not contact a runtime or write data.

Disposable Live Proof

Run only against a new isolated runtime whose service databases and object store can be discarded. The teacher and student tokens must belong to the same organization and the candidate table must already be loaded by the Gateway.

deploy/docker-compose.docx-physics-attempt-proof.yml is the Compose overlay for this rehearsal. It loads the Compose candidate table, exposes only Gateway at 127.0.0.1:18085 and IAM bootstrap at 127.0.0.1:18081, and removes all other host ports. Its BFF target set is limited to exam-service and document-service.

project="hoctapaz-docx-physics-attempt-$(date +%Y%m%d%H%M%S)"
docker compose -p "$project" \
  -f deploy/docker-compose.yml \
  -f deploy/docker-compose.docx-physics-attempt-proof.yml \
  up -d --build

curl -fsS http://127.0.0.1:18085/readyz >/dev/null
curl -fsS http://127.0.0.1:18081/readyz >/dev/null

DOCX_PHYSICS_GATEWAY_ATTEMPT_LIVE_CONFIRM=docx-physics-gateway-attempt-live \
DOCX_PHYSICS_GATEWAY_ATTEMPT_DISPOSABLE=1 \
DOCX_PHYSICS_GATEWAY_BASE_URL=http://127.0.0.1:18085 \
DOCX_PHYSICS_GATEWAY_ORGANIZATION_ID=<isolated-org-id> \
DOCX_PHYSICS_GATEWAY_TEACHER_AUTHORIZATION='Bearer <teacher-token>' \
DOCX_PHYSICS_GATEWAY_STUDENT_AUTHORIZATION='Bearer <student-token>' \
HOCTAPAZ_DOCX_CORPUS_DIR=/Users/velikho/Desktop/test-hoctapaz \
make test-docx-physics-attempt-live

docker compose -p "$project" \
  -f deploy/docker-compose.yml \
  -f deploy/docker-compose.docx-physics-attempt-proof.yml \
  down -v --remove-orphans

The write harness accepts only http://127.0.0.1:18085. Before uploading a file or calling any owner write, it reads /v1/routes and compares the complete normalized table, including route order, targets, target prefixes, methods, auth/organization flags, and roles, to the exact Compose candidate file. Every subsequent request asserts the exact Gateway route name and route state. It uploads the Physics DOCX via document-service, creates a DOCX Fast job using the opaque sourceAssetId, reads the native job-status route immediately after creation and again after the 28-question parse, then approves it into Question Bank. It checks 18/6/4 types from the list then reads each owner-scoped detail to verify answers, solutions, and selectable options, generates a 28-question online exam, publishes it, and verifies the generated default access link through the exam_start_adapter.

The durable Word portion creates a template, creates an export, reads the owner-scoped export list, and downloads its DOCX bytes. The student portion saves a selected-option answer, submits the attempt, and reads its result. Evidence is written under output/qa/docx-physics-gateway-attempt-*; the access-link code is not written to the summary.

No candidate live runtime was started by the static guard. Static evidence is not proof of a default-route promotion.

Local PostgreSQL Candidate Recheck (2026-07-15)

The Docker-free runner creates a native runtime with fresh loopback ports and seven separate databases for IAM, Document, Classroom, Import, Question Bank, Exam, and Attempt. It generates a temporary copy of the localhost candidate table whose targets point only at those fresh ports; the smoke still reads /v1/routes and compares the complete loaded table with that exact copy before its first write.

DOCX_PHYSICS_GATEWAY_ATTEMPT_LOCAL_POSTGRES_CONFIRM=local-postgres \
HOCTAPAZ_DOCX_CORPUS_DIR=/Users/velikho/Desktop/test-hoctapaz \
make test-docx-physics-attempt-local-postgres

The runner registers one TEACHER and one STUDENT in IAM's disposable org_local_center, using an isolated HS256 secret shared only by IAM and the Gateway. The Exam runtime verifier calls IAM with the internal token and uses the live Classroom owner endpoint, so it does not bypass the organization membership decision. The latest 2026-07-15 artifact is output/qa/docx-physics-gateway-attempt-local-postgres-20260715-current/summary.json. It first drove the real Teacher path /teacher/questions/import?teacherImportGateway=native: selection of the Physics file posted the owner-scoped source upload and DOCX Fast create through Gateway, reused the same redacted opaque-asset hash, polled the native job-detail route to COMPLETED, and opened the native editor in 1,966 ms. The corresponding browser Resource Timing records four Gateway fetches (source upload, create, and two polls) and no direct service origin. It then read exam-import-job-status through the dynamic candidate as PROCESSING immediately after creation and as COMPLETED after parsing, with matching correlation IDs, 200 responses, zero pending equations/images, 28 parsed questions, and zero errors. The browser and status artifacts redact bearer, organization, job ID, and warning/error messages while retaining route state, counters, timing, and the asset hash. The same runtime then parsed and approved 28 Physics questions (18/6/4), created a blueprint and published one exam, completed a print export, and took one student attempt through exam_start_adapter to GRADED. The fresh databases ended with two identities, 25 document media assets, three import jobs, 28 Question Bank rows, one exam, and one attempt.

Document metadata is PostgreSQL, but its bytes are deliberately stored in the in-memory object store for this disposable process. The target does not prove S3 durability, Mistral OCR, default route promotion, or production behavior. It does provide a bounded local browser UX proof only. The runner removes all native processes and the temporary cluster after the artifact is written.

Superseded Pre-Fix Capture (2026-07-14)

The prior capture exercised the Physics fixture after registration of disposable TEACHER and STUDENT identities in org_local_center and reported:

• parsed and approved 28 questions with the expected 18/6/4 type split;
• read all owner-scoped Question Bank details and confirmed answer keys, solutions, and selectable options;
• generated and published a 28-question online exam, then created, listed, and downloaded a completed DOCX export with ZIP (PK) bytes;
• started, saved, submitted, and read a student result, which reached GRADED.

That artifact contains no access-link code or bearer token. It does not prove the current isolated-table binding because the former command pointed at :8085 and the former harness checked only candidate route names and states. Do not use it as current live-proof evidence. Rerun the command above after this guard change, verify both /readyz endpoints, and remove the named Compose project. The result remains a non-default candidate rehearsal, never a promotion of deploy/gateway/routes.json.

Fresh Local PostgreSQL Recheck (2026-07-15)

DOCX_PHYSICS_GATEWAY_ATTEMPT_LOCAL_POSTGRES_CONFIRM=local-postgres make test-docx-physics-attempt-local-postgres passed with output/qa/docx-physics-gateway-attempt-local-postgres-20260715101402/summary.json. The disposable Teacher Web flow selected the source file, created the import, reviewed it, and fast-created the exam. It recorded 28 canonical questions (18 single choice, 4 true/false, 6 short answer), a completed print export, and one GRADED attempt. The same runner then mounted the real Student Web candidate, passed its access-link code only in memory, and observed exactly one each of the candidate Gateway start, answer-save, submit, and result-read requests. The page rendered GRADED with 1/28 correct and 3.57%; its 70 ms start latency plus redacted request evidence are in output/qa/docx-physics-gateway-attempt-local-postgres-20260715101402/student-attempt-browser/summary.json. The runner removed its temporary PostgreSQL cluster and native processes after writing the artifact. This remains a local, non-default browser candidate proof and does not change the default Gateway table or prove deployment/production.

Rollback

Restart Gateway with GATEWAY_ROUTE_TABLE=deploy/gateway/routes.json, remove the disposable runtime, and rerun make test-docx-physics-attempt-routes to verify the default table remains legacy-safe.