qbit-document-generation/renderer/VERIFICATION.md

Catalog v4 publication profiles — 2026-10-31 03:55 CDT

88 tests, zero failures/errors/skips and Checkstyle pass in publication-profile-verification.log. ISSN and modern ISMN add checked profiles using the existing Okapi EAN13 carrier; the native executable, patchset, Docker inputs and process boundary are unchanged. Independent ZXing decoding covers four agency/derived/synthetic cases at scales 1/3/8; every case also passes exact PDF embedded-image and ZPL raster equality, with quiet-zone and original-checksum refusal checks. The shared final-image driver adds eight publication format paths and two invalid identifier cases. Exact catalog v4 image execution is pending. The first failed fixture gate is retained separately: the GS1 web example has an invalid original ISSN check digit; strict validation was kept and fixture provenance corrected explicitly. No production or physical scan claim follows.

The optional renderer bridge passes 23 tests and Checkstyle at 03:56:07 (bridges/renderer/publication-profile-verification.log), without installation. Local renderer JAR SHA-256: 384ADC154DF837475EA91F02FE6A16F8FEA04504655E6048A24DAD939755B561. The final-image input bundle must also include the new barcodes/publication-vectors.json resource; the driver class remains com.kingsrook.qbits.renderer.ZintImageQualification.

Catalog v3's actual image gate is sealed at qbit-documents/artifacts/renderer-catalog3-20261031-0342: 85 Linux tests, 45 native reference renders / 15 families, 30 general + 4 numeric + 6 semantic format paths, 9 additional refusals; p50/p95/max 6/66/132ms under one CPU. That historical artifact remains unchanged.

Historical v3 source gate

Current catalog v3 source snapshot — 2026-10-31 03:36 CDT

85 tests, zero failures/errors/skips and Checkstyle passed in zint-six-source-verification.log. The catalog now contains 66 IDs (51 preserved Okapi plus 15 Zint types). The exact catalog v3 image subsequently passed all 45 native reference renders and expanded format/semantic fixtures; it is sealed at qbit-documents/artifacts/renderer-catalog3-20261031-0342. See ZINT-QUALIFICATION.md. The sealed prior p1 image passed its nine-family, numeric-DotCode, UTF-8, exact embedded-pixel and timing gates; that historical artifact remains unchanged. Source tests do not establish hostile containment, carrier acceptance or production throughput.

Historical first-tranche source gate

Additional provider source gate — 2026-10-31

The new catalog v2 source passes 82 tests, zero failures/errors/skips, and Checkstyle (zint-source-verification.log). This preserves the 70-test historical baseline below and adds 12 protocol/geometry/option/process tests. It registers 60 IDs, but native execution of the nine additional IDs is pending the exact-image procedure in ZINT-QUALIFICATION.md. The separate optional renderer bridge uses catalog v2 as well. Do not confuse source fixtures with deployment capability or hostile-runtime qualification.

Verification snapshot

mvnw.cmd -B verify completed successfully at 2026-10-30 20:22:18 America/Chicago using local Temurin Java 21.0.12.1.

• 70 tests, zero failures/errors/skips.
• Zero Checkstyle violations; compilation uses deprecation/unchecked warnings as errors.
• 47 encoder-family reference vectors, 51 exposed IDs including independently tested aliases.
• 14 independent ZXing barcode decode cases.
• Two-page packing-slip PDF corpus with table, escaped fields, retained image and barcode.
• Retained licensed TrueType font embedding.
• 4×6 label PDF decoded after rasterization at the declared 203 DPI.
• ZPL hex escaping, raster barcode output, invalid scene/placement rejection, bounded output, offline resource checks and strict JSON framing.
• Catalog response includes all 51 IDs with typed option metadata.

The two generated PDF raster previews were visually inspected. Trusted fixture artifacts are under target/corpus; Maven evidence is in verify.log and target/surefire-reports (build outputs are ignored). The built renderer JAR SHA-256 at this snapshot is 1fc0348910141e553bd36412dbe0edacdc60985e6685697749895112bca78fc1; this identifies that local build, not an approved container image or release signature.

All executed tests used fixed repository-owned fixtures. No hostile template escape/resource-exhaustion workload, real printer, Docker image build, runsc invocation or deployment change occurred. Upstream codeword vectors are regression evidence, not independent standards certification. No tests establish production throughput, actual host durability, hostile-code containment or every mode/option combination. See qualification.json and DEPLOYMENT.md for remaining release prerequisites.