# Validation report

Last validated: 2026-07-23 on Docker Desktop 4.83.0, Linux engine 29.6.2,
`linux/amd64`.

Deployment was also validated on Unraid OS 7.2.0 using the locally exported
`linux/amd64` image.

## Automated checks

- Ruff formatting and linting: passed
- MyPy strict backend type checking: passed
- Pytest backend suite: 19 passed
- Vitest frontend suite: 2 passed
- TypeScript and Vite production build: passed
- Fresh Alembic migration to revision `0001`: passed
- Unraid XML parsing and read-only `/data/*` mapping validation: passed

## Production-container checks

Image:

```text
reelspace:local
Build version: 0.1.0
```

Verified:

- Multi-stage image build completed from a clean Docker context.
- Entrypoint applied Alembic migrations automatically.
- `/api/health`, `/api/ready`, the bundled SPA, and dashboard API responded.
- Docker healthcheck reached `healthy`.
- A full scan indexed three files from a read-only Docker volume with zero errors.
- An attempted write to the analyzed mount failed with `Read-only file system`.
- `/config/reelspace.db` was owned by the configured `PUID=1000` and `PGID=1000`.
- A one-second synthetic H.264 video was scanned from a read-only Docker volume.
- Bundled `ffprobe` recorded the video and normalized its resolution to `720p`.
- `REELSPACE_VERSION` exposed the Docker build version through the API and About screen.
- With `REELSPACE_AUTH_ENABLED=true`, an unauthenticated API request returned `401`.
- First-administrator setup created an Argon2-backed account and expiring session.
- A state-changing request without a CSRF token returned `403`.
- The same request with the issued CSRF token succeeded.
- A stopped legacy `psi-config` volume was copied to `reelspace-config`; startup
  migrated `psi.db` into `reelspace.db`, and SQLite integrity validation passed.
- The live process ran as the configured Unraid identity `99:100`.
- The image archive SHA-256 was verified on Unraid before it was loaded.
- The Unraid container reached `healthy`, served the ReelSpace UI and version API,
  persisted `/config` under `/mnt/user/appdata/reelspace`, and mounted
  `/mnt/user/Media` read-only at `/data/media`.
- Unraid Docker Manager recognized the container, its Web UI link, and its volume
  mappings; autostart was enabled and `my-reelspace.xml` was persisted on the flash
  device for editing and recreation.

Temporary containers and volumes were removed after the test. The local smoke image was
retained as `reelspace:local`, and the pre-ReelSpace container and volume were retained
in a stopped state for rollback.