# Ashim QA Release Report

**Date:** 2026-04-23
**Version:** 1.15.9
**Commit:** 136a4dd (main) + local fixes (uncommitted)
**Nodes Tested:** 3 (Mac orchestrator, WSL GPU RTX 4070, Ubuntu CPU)
**Total Execution Time:** ~4 hours (including AI bundle installations)

## Executive Summary
- Total tests executed: **~280**
- Passed: **~270**
- Failed: **7** (3 known platform limitations, 1 caire bug, 3 CPU-only AI limitations)
- Fixed during testing: **2 bugs**
- Cross-platform parity: **Confirmed** (identical non-AI results on both nodes)

## Bugs Found & Fixed

| # | Severity | Category | Description | Status |
|---|----------|----------|-------------|--------|
| 1 | **Critical** | Auth | `MAX_USERS=0` blocks all user registration. The guard `if (MAX_USERS > 0)` was missing, so `userCount >= 0` (1 >= 0) was always true. | **Fixed** in `auth.ts:513` |
| 2 | **Medium** | Auth | Auth request bodies used unsafe `as` casts instead of Zod validation for login, register, change-password, update-user, reset-password | **Fixed** - added Zod schemas |
| 3 | **Low** | Formats | BMP files (Windows 98/2000 V4/V5 headers) fail Sharp metadata read | Known - needs BMP in CLI_DECODED_FORMATS |
| 4 | **Low** | Formats | EXR format fails - ImageMagick in Docker lacks EXR decode delegate | Known - needs `libopenexr-dev` in Dockerfile |
| 5 | **Low** | AI | caire binary crashes on large images (6.7MB stress-large.jpg) for content-aware-resize | Known - caire limitation on both GPU+CPU |
| 6 | **Info** | AI | PaddleOCR Japanese fails on CPU (MKLDNN PIR attribute error) | Expected - CPU PaddlePaddle build limitation |
| 7 | **Info** | AI | Upscale (Real-ESRGAN) times out on CPU (>300s for 100x100 image) | Expected - model too heavy for CPU inference |

## Test Matrix

### API Contract Tests - Essential + Watermark Tools (35 tests)

| Tool | WSL GPU | CPU | Notes |
|------|---------|-----|-------|
| resize (3 tests) | PASS | PASS | cover, percentage, withoutEnlargement |
| crop (2) | PASS | PASS | px, percent |
| rotate (2) | PASS | PASS | 90deg, flip |
| convert (5) | PASS | PASS | png, webp, avif, tiff, gif |
| compress (2) | PASS | PASS | quality, targetSize |
| strip-metadata (2) | PASS | PASS | strip, inspect |
| edit-metadata (2) | PASS | PASS | edit, inspect |
| adjust-colors (5) | PASS | PASS | sliders, grayscale, sepia, invert, channels |
| sharpening (4) | PASS | PASS | adaptive, unsharp-mask, high-pass, denoise |
| watermark-text (2) | PASS | PASS | center, tiled |
| watermark-image (1) | PASS | PASS | field: `watermark`, scale: 1-100 |
| text-overlay (1) | PASS | PASS | |
| compose (4) | PASS | PASS | overlay, multiply, screen, difference |

**Result: 35/35 PASS on both nodes**

### API Contract Tests - Utility + Layout + Format (44 tests)

| Tool | WSL GPU | CPU | Notes |
|------|---------|-----|-------|
| info (2) | PASS | PASS | PNG, HEIC |
| compare (2) | PASS | PASS | identical, different |
| find-duplicates (1) | PASS | PASS | |
| color-palette (1) | PASS | PASS | |
| qr-generate (1) | PASS | PASS | |
| barcode-read (2) | PASS | PASS | barcode, QR |
| image-to-base64 (1) | PASS | PASS | |
| collage (2) | PASS | PASS | templateId: `2-h-equal`, `4-grid` |
| stitch (3) | PASS | PASS | horizontal, vertical, grid |
| split (2) | PASS | PASS | grid, tile |
| border (1) | PASS | PASS | |
| svg-to-raster (2) | PASS | PASS | PNG, JPG |
| vectorize (2) | PASS | PASS | B&W, color |
| gif-tools (8) | PASS | PASS | resize, optimize, speed, reverse, extract all/single, rotate, info |
| pdf-to-image (5) | PASS | PASS | all pages, single, grayscale, info, preview |
| optimize-for-web (2) | PASS | PASS | |
| bulk-rename (1) | PASS | PASS | |
| favicon (1) | PASS | PASS | |
| image-to-pdf (1) | PASS | PASS | |
| replace-color (2) | PASS | PASS | solid, transparent |

**Result: 44/44 PASS on both nodes**

### Input Format Support (18 formats per node)

| Format | GPU (WSL) | CPU (Ubuntu) | Notes |
|--------|-----------|-------------|-------|
| JPEG | PASS | PASS | |
| PNG | PASS | PASS | |
| WebP | PASS | PASS | |
| GIF | PASS | PASS | |
| BMP | **FAIL** | **FAIL** | Sharp can't read V4/V5 BMP metadata |
| TIFF | PASS | PASS | |
| Multi-page TIFF | PASS | PASS | |
| AVIF | PASS | PASS | |
| SVG | PASS | PASS | Sanitized before processing |
| HEIC | PASS | PASS | Decoded via heif-dec |
| HEIF | PASS | PASS | Decoded via heif-dec |
| DNG (RAW) | PASS | PASS | Decoded via dcraw |
| PSD | PASS | PASS | Decoded via ImageMagick |
| TGA | PASS | PASS | Decoded via ImageMagick |
| EXR | **FAIL** | **FAIL** | Missing ImageMagick EXR delegate |
| HDR | PASS | PASS | |
| ICO | PASS | PASS | |
| PDF | PASS | PASS | Via pdf-to-image tool |

**Result: 16/18 per node. Identical results = perfect parity.**

### Batch + Pipeline Tests (20 tests - CPU node)

| Test | Result | Notes |
|------|--------|-------|
| Batch resize (5 images) | PASS | |
| Batch convert (5 JPGs -> WebP) | PASS | |
| Batch compress (3 images) | PASS | |
| Batch watermark-text (3 images) | PASS | |
| First-Image-Only Bug Hunt | PASS | All 5 files in ZIP |
| Mixed format batch (JPG+PNG+WebP+HEIC) | PASS | HEIC auto-decoded |
| Large batch (11 images) | PASS | |
| Batch SSE progress | PASS | totalFiles/completedFiles correct |
| Simple pipeline [resize] | PASS | |
| 2-step [resize, convert] | PASS | |
| 3-step [crop, rotate, compress] | PASS | |
| 5-step pipeline | PASS | |
| Pipeline with AI tool | PASS | remove-bg works in pipeline |
| Pipeline batch (3 images) | PASS | |
| Save/List/Delete pipeline | PASS | |
| Available tools | PASS | 32 tools registered |
| Max steps limit (21) | PASS | 400 error |
| Invalid tool error | PASS | Clear error message |

**Result: 20/20 PASS. Also verified batch+pipeline on GPU node.**

### AI Tools - GPU (WSL RTX 4070)

| Tool | Status | Time | Notes |
|------|--------|------|-------|
| remove-bg transparent | PASS | 9.7s | |
| remove-bg color | PASS | 5.2s | Blue background applied |
| remove-bg blur | PASS | (verified earlier) | |
| upscale 2x | PASS | 6.3s | |
| upscale face-enhance | PASS | 8.3s | |
| ocr fast (en) | PASS | 1.1s | |
| ocr best (en) | PASS | 69.8s | |
| ocr japanese | PASS | 27.4s | |
| ocr auto | PASS | 9.4s | |
| blur-faces multi | PASS | 0.27s | |
| blur-faces single | PASS | 0.19s | |
| smart-crop face | PASS | 0.11s | |
| red-eye-removal | PASS | 0.28s | |
| colorize full | PASS | 10.1s | |
| colorize partial | PASS | 9.2s | |
| enhance-faces gfpgan | PASS | 2.3s | |
| enhance-faces codeformer | PASS | 3.0s | |
| enhance-faces multi | PASS | 2.6s | |
| noise-removal quick | PASS | 0.017s | |
| noise-removal quality | PASS | 18.2s | |
| restore-photo auto | PASS | 31.4s | |
| restore-photo light | PASS | 5.1s | |
| content-aware-resize (large) | **FAIL** | 100.5s | caire crash on 6.7MB image |
| content-aware-resize (face) | PASS | 16.2s | |
| image-enhancement auto | PASS | 0.25s | |
| image-enhancement analyze | PASS | 0.019s | |
| passport-photo analyze | PASS | 17.9s | Includes HEIC decode |

**Result: 26/27 PASS (1 caire bug on large image)**

### AI Tools - CPU Fallback (Ubuntu)

| Tool | CPU Status | CPU Time | GPU Time | Notes |
|------|-----------|----------|----------|-------|
| remove-bg transparent | PASS | 27.7s | 9.7s | 2.9x slower |
| remove-bg color | PASS | 21.4s | 5.2s | 4.1x slower |
| ocr fast (en) | PASS | 2.0s | 1.1s | 1.8x slower |
| ocr best (en) | PASS | 242.5s | 69.8s | 3.5x slower |
| ocr japanese | **FAIL** | 45.0s | 27.4s | PaddlePaddle MKLDNN bug |
| blur-faces multi | PASS | 27.1s | 0.27s | 100x slower |
| blur-faces single | PASS | 0.27s | 0.19s | Similar |
| smart-crop face | PASS | 0.14s | 0.11s | Similar |
| colorize | PASS | 12.9s | 10.1s | 1.3x slower |
| enhance-faces gfpgan | PASS | 27.7s | 2.3s | 12x slower |
| noise-removal quick | PASS | 228.0s | 0.017s | 13,400x slower! |
| red-eye | PASS | 0.46s | 0.28s | Similar |
| restore-photo auto | PASS | 89.6s | 31.4s | 2.9x slower |
| content-aware-resize | **FAIL** | 121.5s | 100.5s | caire crash (both) |
| image-enhancement auto | PASS | 0.09s | 0.25s | CPU faster (Sharp-only) |
| image-enhancement analyze | PASS | 0.04s | 0.019s | Similar |
| upscale 2x | **FAIL** | >300s | 6.3s | Timeout (too slow for CPU) |

**Result: 14/17 PASS, 3 expected CPU limitations**

### Auth + RBAC + Admin Tests

| Test | WSL | CPU |
|------|-----|-----|
| Login success | PASS | PASS |
| Login wrong password (401) | PASS | PASS |
| Login nonexistent user (401) | PASS | PASS |
| Login empty body (400) | PASS | PASS |
| Session validation (200) | PASS | PASS |
| Session invalid token (401) | PASS | PASS |
| Logout (200) | PASS | PASS |
| Post-logout session (401) | PASS | PASS |
| Register user | PASS | PASS |
| Register duplicate (409) | PASS | PASS |
| RBAC enforcement (403) | PASS | PASS |
| Admin escalation prevention (403) | PASS | PASS |
| Delete self prevention (400) | PASS | PASS |
| Last admin protection (400) | PASS | PASS |
| API key create (si_ prefix) | PASS | PASS |
| API key auth for tools (200) | PASS | PASS |
| Scoped key tools work | PASS | PASS |
| Scoped key admin blocked (403) | PASS | PASS |
| Deleted key rejected (401) | PASS | PASS |
| Roles endpoint | PASS | PASS |
| Teams endpoint | PASS | PASS |
| Audit log endpoint | PASS | PASS |
| Settings endpoint | PASS | PASS |
| Features endpoint | PASS | PASS |
| Health check | PASS | PASS |
| llms.txt / llms-full.txt | PASS | PASS |
| OpenAPI spec | PASS | PASS |

**Result: All PASS on both nodes**

### Security Tests (WSL)

| Test | Result | Details |
|------|--------|---------|
| Path traversal (download) | PASS | 404 |
| Path traversal (files) | PASS | SPA fallback, not real traversal |
| SVG XXE | PASS | 400 - sanitized |
| SVG SSRF | PASS | 400 - blocked |
| SVG script injection | PASS | Script stripped, image processed |
| SQL injection (login) | PASS | Normal 401 rejection |
| Rate limiting | PASS | 429 at request 9 |
| Token reuse after logout | PASS | 401 |
| Unauthenticated tool access | PASS | 401 |
| Malicious file (.exe as .jpg) | PASS | 400 - magic bytes rejected |
| Header injection | PASS | No impact |

**Result: 11/11 PASS**

### Stress / Performance

| Test | Result | Details |
|------|--------|---------|
| Large file (6.7MB) resize | PASS | 0.4s |
| 10 concurrent requests | PASS | All 200 |
| 20-image batch | PASS | All complete (Agent 10) |
| 10-step pipeline, 5 images | PASS | No corruption |

**Result: 4/4 PASS**

### Cross-Platform Parity

| Check | Match? | Notes |
|-------|--------|-------|
| Non-AI tools (79 tests) | YES | Identical results |
| 18 input formats | YES | Same 16/18 pass, same 2 fail |
| Batch processing | YES | Identical behavior |
| Pipeline execution | YES | Identical behavior |
| Auth/RBAC | YES | Identical behavior |
| AI tools on CPU | Partial | 14/17 work; 3 expected GPU-only limitations |

## GPU vs CPU Performance Summary

| Operation | GPU | CPU | Speedup |
|-----------|-----|-----|---------|
| noise-removal (quick) | 17ms | 228s | **13,400x** |
| blur-faces (multi) | 0.27s | 27.1s | **100x** |
| upscale 2x | 6.3s | >300s (timeout) | **>47x** |
| enhance-faces (gfpgan) | 2.3s | 27.7s | **12x** |
| remove-bg | 5.2-9.7s | 21-28s | **3-4x** |
| ocr (best) | 69.8s | 242.5s | **3.5x** |
| restore-photo (auto) | 31.4s | 89.6s | **2.9x** |
| colorize | 10.1s | 12.9s | **1.3x** |
| image-enhancement | 0.25s | 0.09s | CPU faster (Sharp-only) |

## API Parameter Format Reference

```bash
# Single-file tool
curl -X POST -F "file=@image.jpg" -F 'settings={"width":100}' \
  -H "Authorization: Bearer TOKEN" http://host:1349/api/v1/tools/TOOL

# Multi-file (collage, stitch, compare, find-duplicates, bulk-rename, image-to-pdf)
curl -X POST -F "file=@img1.jpg" -F "file=@img2.jpg" -F 'settings={...}' ...

# Watermark-image: field name is "watermark"
curl -X POST -F "file=@main.jpg" -F "watermark=@logo.png" -F 'settings={...}' ...

# Compose: field name is "overlay"  
curl -X POST -F "file=@base.jpg" -F "overlay=@top.jpg" -F 'settings={...}' ...

# Pipeline: field name is "pipeline"
curl -X POST -F "file=@img.jpg" \
  -F 'pipeline={"steps":[{"toolId":"resize","settings":{"width":100}}]}' ...

# Notes: crop uses left/top (not x/y), scale in watermark-image is 1-100
```