adaptive_detail_reads_no_lists | mastery_engine | Detail-only reads ship for policy and calibration; adaptive state is a bounded detail composition returned by :inspect/:advance, with KC classifications embedded; no collection list or sub-collection ships. | ITD-004 |
adaptive_post_idempotency | mastery_engine | Every POST requires a 1–255 character Idempotency-Key. Before any side effect, one server-only Postgres transaction inserts or reads a 24-hour control record uniquely keyed by (tenant_id, method, canonical_path, HMAC(server_secret, key)) and containing only canonical_request_hash, operation_id, lifecycle state, terminal status, and timestamps—never a response, answer, score, candidate id, session id, or result id. A different canonical request hash returns 409 idempotency-key-reused before upstream work. The same hash resumes/recomposes semantically: runNonce, QTI candidate refs, operation id, and downstream idempotency keys derive deterministically from the scoped key plus request hash, and the engine rereads authoritative upstreams rather than replaying stored learner data. The table is API-fronted, tenant-scoped, inaccessible to anon/authenticated browser roles, and purged after 24 hours. | ITD-007 |
adaptive_query_model_deferred | mastery_engine | lookup by exact immutable identifier only. | ITD-005 |
adaptive_run_signed_continuation | mastery_engine | An A256GCM authenticated-encrypted compact JWE continuation identifies the adaptive composition and carries only tenant-bound native refs, configuration/content hashes, per-offer pseudonymous QTI candidate/session ids, sequence, iat/exp, kid, and a random nonce; AlphaTest persists no run row. | ITD-002 |
adaptive_stream_optimistic_concurrency | mastery_engine | Inspect/start return a strong ETag over token pins and canonical token-named QTI attempts; advance requires exact If-Match and acquires a tenant-scoped advisory lock on the token runNonce only for the request. | ITD-006 |
adaptive_write_granularity | mastery_engine | start, advance, inspect, and bounded synthetic simulation are individual POST operations; no bulk write ships. | ITD-003 |
administration_accommodation_enforcement_boundary | administration | DEFER non-default accommodations and any claim that QTI applies them. V1 accepts only an absent accommodations object or the semantic no-op {default:{timeMultiplier:1},candidateOverrides:[]}; every non-default request returns 422 qti-accommodation-capability-required. Reopen only when authenticated wire probes prove QTI delivery-session creation accepts a documented accommodation payload and a pre-start update operation mutates it. | ITD-018 |
administration_adaptive_owner_binding | administration | For each adaptive candidate attempt, Administration calls mastery_engine POST /v1/adaptive-runs with the six request-level pins plus that candidate's validated resultsStudentId, using a deterministic child Idempotency-Key. mastery_engine alone creates the first and subsequent native QTI sessions. Administration binds tenantId+administrationId+candidateSourcedId+attemptNumber to the returned opaque continuationToken, strong ETag, expiry, and offeredItem.deliverySessionId; launch returns only the current native QTI reference, and advance calls mastery_engine :advance with the stored token and If-Match then atomically replaces token+ETag+offer. It stores no decrypted token claim, response, posterior, score, or mastery state. | ITD-033 |
administration_adaptive_public_state | administration | Adaptive candidates preserve the public four-state contract by composition: not_started before the first offered QTI session is launched; in_progress after launch while mastery_engine reports in_progress; submitted while mastery_engine reports finalizing with no offered item; and scored only when inspect reports completed with reportable scale output and acknowledged Results KC components. POST /v1/administrations/{id}/close rejects 409 close-not-ready while any launched adaptive attempt is not scored, then stops new launches/retakes, inspect-verifies every completed run and Results reference, and marks the parent scored without copying the scale score, KC map, continuation contents, or Results body. | ITD-036 |
administration_adaptive_release_evidence | administration | bind Content, OneRoster, QTI, Results, Reports, Caliper, and mastery_engine only through explicit UPSTREAM_* base URLs backed by approved callable contracts and deployment probes; authenticate Platform3 calls with the server-selected credential profile whose tenant equals the verified JWT tenantId. The adaptive API contract is SHIP, but its implementation release is fail-closed: no deployment may advertise adaptive success until an approved callable mastery_engine immutable URL proves authenticated start/inspect/advance, native QTI session creation, Results KC acknowledgement, same-tenant success, bidirectional cross-tenant denial, and transient-unavailable behavior. Repository-local code, fixtures, health responses, guessed aliases, or typed permanent-failure stubs are not evidence. | ITD-035 |
administration_adaptive_resumable_fanout | administration | Adaptive provisioning is per-candidate and resumable, never distributed all-or-nothing. Validation failure returns 422 adaptive-capability-required before persistence. After 202 acceptance, a mastery_engine transport, 5xx, or invalid dependency response marks only that candidate attempt provisioning_failed with retryable dependency metadata and surfaces 424 mastery-engine-unavailable on synchronous provision/advance calls; the administration remains provisioning_with_errors and POST /v1/administrations/{id}/provision retries only failed candidates with the original deterministic child keys. Expired continuation returns 409 adaptive-continuation-expired and requires a policy-permitted retake, which starts attemptNumber+1 with a fresh child key and continuation. Cross-tenant resources and continuations return the same 404 resource-not-found in both directions, before effects. | ITD-034 |
administration_async_creation | administration | POST persists the administration then returns 202 + Location; that resource itself exposes provisioning progress and errors. | ITD-014 |
administration_audit_retention | administration | no v1 DELETE endpoint; retain audit glue seven years by default, purge idempotency bodies after 24 hours and redacted operational logs after 30 days; upstream deletion/anonymization is reflected on composition. | ITD-012 |
administration_bounded_upstream_fanout | administration | provision and reconcile with bounded concurrency, exponential backoff plus jitter for retryable upstream failures, honor Retry-After, and expose counts/errors on the administration without claiming completion. | ITD-024 |
administration_canonical_lists | administration | provide a canonical administrations collection and candidates subcollection; clients never need to persist returned IDs merely to rediscover resources. | ITD-013 |
administration_class_or_candidate_list_target | administration | SHIP a required discriminated target: either {type:"class", oneRosterSourcedId} or {type:"candidate_list", oneRosterCandidateSourcedIds} with 1–1000 unique IDs; provisioning tenant-authorizes and resolves every ID live in OneRoster and rejects the whole request on any missing, inactive, duplicate, or unauthorized candidate. Fixed-form provisioning creates one QTI session per candidate; adaptive provisioning calls mastery_engine once per candidate and accepts only its native QTI offer. Both retain only the immutable binding defined by ITD-015. | ITD-026 |
administration_close_qti_results_writeback | administration | SHIP POST /v1/administrations/{id}/close for fixed-form administrations. Using only the server-side provisioned PLATFORM3_TENANT/PLATFORM3_JWT credential, close stops new launch and retake authorization; requires every launched candidate's latest QTI attempt to be submitted or scored; reads the authoritative QTI outcomeState.SCORE; sends that outcome to POST /alpha/results/v1/result-records with the complete typed reference set administration_id, qti_attempt_id, qti_session_id, qti_test_id, qti_artifact_version_id, content_test_spec_id, test_kind, and subject; verifies exactly one settled record through GET /alpha/results/v1/result-records?qtiAttemptId={qtiAttemptId} carrying the same administration_id and reference set; and advances the administration to scored only after every candidate write verifies. Close is asynchronous, requires Idempotency-Key, derives a stable child key per QTI attempt, and resumes partial failure without duplicating Results facts. | ITD-030 |
administration_complete_test_kind_contract | administration | SHIP mastery_gate, formative, and adaptive_diagnostic through the same administration resource selected by required testKind. Adaptive create requires adaptiveConfig with selectionPolicyId, scaleCalibrationId, testBankId, bankOperationId, runMode=production_learner, and an exact resultsStudentBindings entry for every resolved OneRoster candidate; testSpecId is test.contentTestSpecId. A missing, duplicate, extra, or cross-tenant binding returns 422 adaptive-capability-required before persistence or upstream effects. A valid request returns 202 and provisions one mastery_engine run per candidate asynchronously. | ITD-032 |
administration_cursor_query_model | administration | the administrations collection supports exact status, testKind, qtiTestId, target sourcedId, modifiedSince, opaque cursor, and limit 1–100; modifiedSince reads order by modifiedAt,id ascending and browse reads by modifiedAt,id descending. The candidates subcollection supports state, opaque cursor, and limit 1–100 over immutable bindings ordered by createdAt,id ascending; each cursor advances over examined bindings even when a live QTI state filter removes rows. DEFER candidate modifiedSince until QTI exposes a monotonic runtime cursor. | ITD-004 |
administration_deterministic_form_rotation | administration | accept a retake only while the administration lifecycle is open and the candidate's authoritative QTI state is submitted or scored; otherwise return 409 administration-state-conflict. For mastery gates, exclude prior forms using QTI attempt history, select the least-used eligible parallel form, stable-hash ties, and return 409 parallel-forms-exhausted when policy or inventory is exhausted. | ITD-017 |
administration_fixed_gate_assignability | administration | Before persisting an administration or touching OneRoster or QTI, fixed mastery-gate create MUST read the requested Content test_spec and test_bank in the verified JWT tenant and accept only when the bank is status=published, is_mastery_gate=true, membership_rule=same_blueprint_fixed_forms, spec_id exactly equals the requested contentTestSpecId, and its exact ordered member set is non-empty and every immutable QTI artifact version dereferences. A Bank operation's ready or assignable flag is correlation evidence only and cannot override Content. Any mismatch returns 422 test-not-assignable before effects. Bank may declare the output ready and assignable only after authoritative Content read-back proves this same predicate and a same-tenant Administration create contract probe accepts the returned native IDs. | ITD-037 |
administration_immutable_candidate_bindings | administration | resolve the OneRoster target during provisioning and persist one immutable candidate-attempt binding. Fixed-form bindings contain tenantId, administrationId, candidateSourcedId, QTI candidate/session ref, selected form ref, and receipt. Adaptive bindings add only attemptNumber, caller-supplied same-tenant resultsStudentId, the opaque mastery_engine continuation JWE, its strong ETag and expiry, and current offered QTI deliverySessionId; Administration never decrypts the token and replaces token+ETag atomically after advance. Identity is reread from OneRoster, adaptive state from mastery_engine, and session/attempt state from QTI; no owner body, response, posterior, score, or mastery classification is stored. | ITD-015 |
administration_jwt_tenant_routing | administration | route and scope all data by verified tenantId; optional X-Timeback-Tenant must match exactly and never selects a tenant. | ITD-010 |
administration_launch_window_boundary | administration | SHIP opensAt/closesAt enforcement at AlphaTest's launch-authorization boundary by withholding the bound deliverySessionRef before or after the window; keep timeLimitSeconds explicitly nominal and DEFER any claim that QTI terminates delivery or enforces duration. Reopen duration enforcement only when authenticated probes prove QTI session create/update accepts and applies not-before, not-after, and effective-duration policy. | ITD-031 |
administration_live_conformance_evidence | administration | publish an OpenAPI-driven contract suite, anonymous/cross-tenant probes, and live network/log evidence for every declared Platform3 capability; QTI references must dereference in the real runtime. Fixed-form proof replays create → launch → submitted QTI attempt → outcomeState.SCORE → Results create → exact ?qtiAttemptId= read-back → scored. Adaptive proof replays same-tenant create → per-candidate mastery start → native QTI offer → inspect/advance → Results KC acknowledgement, plus tenant-A-to-B and tenant-B-to-A denials and transient mastery-engine failure/resume. No adaptive implementation may release without an approved callable mastery_engine URL and immutable receipts for that exact trace. | ITD-011 |
administration_orchestration_references_only | administration | AlphaTest stores only tenant-scoped administration policy, upstream identifiers, idempotency receipts, and reconciliation metadata; OneRoster, QTI, Results, Caliper, Content, and Analytics remain authoritative for their records. | ITD-001 |
administration_path_major_versioning | administration | major version in path; additive optional fields and enum values require tolerant readers, while removals/semantic breaks require a new major and published overlap window. | ITD-023 |
administration_per_resource_writes | administration | SHIP per-administration create/update/provision-resume/close and per-candidate launch/advance/retake writes; DEFER bulk administration writes until one integrator must atomically schedule at least 100 distinct classes. | ITD-002 |
administration_polling_event_model | administration | SHIP client polling of AlphaTest list/detail with modifiedSince; for candidate composition, read QTI runtime data once per persisted binding because QTI has no administration cursor. DEFER public webhooks until two external consumers require sub-30-second push updates and can supply signed-receiver operational ownership. | ITD-008 |
administration_post_idempotency | administration | create, provision-resume, first launch, adaptive advance, retake, and close require Idempotency-Key (1–255 chars), scoped by tenant+method+path, retained 24 hours; identical replay returns the original accepted operation with Idempotent-Replayed: true, while a changed payload returns 409 idempotency-key-reused. Adaptive provisioning derives a stable mastery-engine child key from tenantId+administrationId+candidateSourcedId+attemptNumber+canonical start hash; close derives one stable Results child key per tenant+administration+QTI attempt. | ITD-006 |
administration_privacy_safe_observability | administration | propagate a request/correlation ID to each upstream, log tenant-hashed administration and upstream reference hashes, dependency latency/status, and reconciliation counts; never log JWTs, response bodies, names, raw sourcedIds, answers, or scores. | ITD-025 |
administration_problem_details | administration | every non-2xx response is application/problem+json with stable HTTPS type, title, status, detail, instance, code, requestId, retryable, and field errors; dependency failures use 424 and name the dependency. | ITD-009 |
administration_public_composed_origin | administration | SHIP one unauthenticated documentation origin whose root, /architecture, and /reference routes remain present in every later deliverable bundle, while authenticated API routes live under /api; a deployment must fail smoke rather than replace a previously published documentation route or require Vercel SSO. | ITD-027 |
administration_qti_runtime_state | administration | derive not_started/in_progress/submitted/scored from QTI runtime data on read or reconciliation; local lifecycle describes orchestration only. | ITD-016 |
administration_read_shape | administration | ship tenant list and detail resources plus a separately authorized candidates subcollection; allow include=candidates only when the administration has at most 100 bindings, otherwise return 422 candidates-page-required and direct callers to the subcollection. | ITD-003 |
administration_scoped_platform_jwt | administration | require a verified Platform HS256 bearer JWT with sub, role, tenantId, iat, exp; map role to a published maximum permission set, allow an optional scope claim only to narrow that set, and apply optional school/class constraints. Standard five-claim reviewer tokens therefore authenticate without an undocumented scope requirement; candidate/session reads still require a role permission that includes sensitive administration reads. | ITD-007 |
administration_strong_etags | administration | detail responses carry a strong ETag; PATCH requires If-Match and returns 412 on stale policy. QTI-derived candidate state is never updated through AlphaTest. | ITD-005 |
bank_adaptive_pool_manifest_projection | bank | QTI owns the adaptive pool root and authoritative ordered member identities; Content owns each imported item's KC relationships. For each ordered QTI member, Bank reconciles its native immutable QTI identity to the Content contentId, then reads GET .../items/{contentId}/kc-tags and requires exactly one primary relationship whose knowledgeComponentGuid equals the generated blueprint slot (with owner-published weight/confidence retained). Bank MUST NOT require caseStandardGuids or knowledgeComponentGuids on QTI item refs, infer KC from titles, or add KC metadata to QTI. Missing, duplicate-primary, mismatched, or unreconciled Content KC proof fails closed. Exact immutable operation bop_3BZPK6BKJ91MS9RP4VXRAYR7KG is the regression shape: conformance must preserve root 66338a93-fe08-4f1a-80f5-39c51032b2dc and its six-member QTI order, obtain KC proof from Content, and reach ready, assignable:true, non-null stable adaptivePool, zero gaps, and sanitized QTI/Content/KC-owner receipts. Public qti_adaptive_selection admission and the stable alias remain unchanged until that positive mode receipt is explicitly published; repeat reads must preserve the canonical manifest hash and strong ETag. | #bank-itd-017 |
bank_api_fronted_security | bank | Supabase/Postgres is server-only; service credentials never reach clients. Every operation, idempotency, checkpoint, and evidence query includes the verified JWT tenant claim; cross-tenant identifiers return indistinguishable 404. | #bank-itd-015 |
bank_async_operation | bank | After the requested capability's dependency preflight passes, generation or legacy alias-proof import returns 202 with one stable operation URI and runtime terminal states ready, ready_with_gaps, failed, or cancelled. For generated fixed/adaptive banks, only ready with that capability's complete owner receipt may be assignable; for legacy alias proof, ready means all 17 owner aliases were proven with bankId:null, ownerMutationCount:0, and assignable:false. The immutable release-conformance suite is stricter than ordinary runtime observation: fixed, adaptive, and all-17-legacy replay are three required assertions, and each MUST terminate ready with zero gaps before the suite can record certification—merely reaching failed or another terminal is a failed assertion, never a pass. | #bank-itd-002 |
bank_auth_shape | bank | Require a signed unexpired caller Bearer JWT with sub,role,tenantId,iat,exp; reads require bank:read and writes bank:write. Upstream calls use distinct server-held least-privilege CONTENT_SERVICE_TOKEN, QTI_SERVICE_TOKEN, and CASE_SERVICE_TOKEN credentials (plus the separate Incept credential where generation runs). No slot may fall back to PLATFORM3_JWT, another service's token, the caller token, or a demo mint; missing, mismatched, expired, or under-scoped credentials fail closed before certification. | #bank-axis-006 |
bank_concurrency_model | bank | No public PATCH/PUT; snapshots return ETags for cache validation. Each upstream mutation requiring If-Match uses the ETag read from that same tenant resource. | #bank-axis-004 |
bank_conformance_evidence | bank | One immutable-host conformance run covers fixed, adaptive, and the governed all-17 legacy alias-proof operation under the configured reviewer-bank/QTI tenant binding, while producing three independent mode receipts. Every assertion requires status=ready and zero gaps; failed, cancelled, ready_with_gaps, timeout, or missing evidence fails the suite. Receipts retain sanitized Content/QTI/CASE/Incept host, method, status, native IDs/hashes, request/trace IDs, and timestamps; prove distinct credential slots, public-alias fail-closed behavior for uncertified modes, anonymous rejection, same-shape 404 cross-tenant isolation, idempotency conflict, QTI scoring, generated-bank Content registration/read-back, adaptive QTI-order plus Content-KC reconciliation, and exact all-17 alias replay with bankId:null, ownerMutationCount:0, assignable:false. A green fixed receipt cannot certify adaptive or legacy, and a later failed sibling replay cannot revoke the already published fixed certification. | #bank-axis-010 |
bank_content_qti_write_through | bank | Submit deterministic QTI 3.0 ZIP once to Content’s QTI-package import with server auth and child idempotency key; require 202, trusted import, and created native IDs, then read each QTI delivery JSON by returned version ID and verify identity plus canonical hash. Never double-ingest through QTI. | #bank-itd-012 |
bank_content_registration | bank | For generated fixed/adaptive capabilities, create content_kind:"test_bank" through Content’s authenticated, idempotent item-create endpoint only after owner identities are reconciled. Fixed mode writes ordered bank_member references with exact Content/QTI aliases; adaptive mode writes no fabricated fixed member rows because selection remains QTI-owned. Require item detail and the mode-appropriate authoritative read-back before assignable ready. Legacy alias proof is excluded from this mutation contract: it returns bankId:null, ownerMutationCount:0, assignable:false and creates no Content test_bank or bank_member rows. | #bank-itd-013 |
bank_deterministic_qti3_conversion | bank | The converter maps Incept artifact semantics to canonical QTI 3.0 XML, response declarations/processing, accessibility metadata, media resources, and CASE tags. Equal normalized input plus converter version yields the same package hash; conversion may reject but never rewrite content. | #bank-itd-006 |
bank_error_envelope | bank | Every non-2xx is application/problem+json with stable type/title/status/detail/code/requestId/traceId and optional safe field/upstream arrays; never expose tokens, item bodies, or answer keys. | #bank-axis-008 |
bank_eventing_model | bank | v1 ships polling, Retry-After, ETag, and modifiedSince. Webhooks reopen when a registered external consumer proves polling misses a documented assignment-latency SLO and supplies a signed-callback receiver. | #bank-axis-007 |
bank_explicit_capability_gaps | bank | If Incept cannot generate, the converter cannot represent, or QTI cannot score a requested type, record the exact slot and boundary, open/link an upstream Issue with a reproducer and proof metric, and return only a non-assignable audit result when blueprint policy permits. | #bank-itd-008 |
bank_idempotency_model | bank | Every public POST requires Idempotency-Key. Same tenant/key and canonical request returns the same operation; changed method/path/body returns typed 409. Deterministic child keys isolate upstream writes. | #bank-axis-005 |
bank_incept_manifest_v1_binding | bank | Fetch GET https://incept-skill-pack.vercel.app/api/skill-pack before a run and require schemaVersion===1, generation endpoint equality, bearer auth, available question skill, and declared request/response schemas. POST one slot with skillId:"question", canonical subject/grade, parameters.mode:"brainlift", CASE URI/identifier in parameters.target, the exact manifest-enumerated parameters.dok and parameters.interactionType, and intent.purpose:"assessment". Accept only HTTP 2xx with ok:true, outcome:"artifact", nonempty generationRunId, and artifact; preserve run ID and response hash. A requested interaction outside the live enum or a blocked outcome is a slot gap, never locally reconstructed. | #bank-itd-011 |
bank_legacy_import_in_place | bank | Immutable conformance MUST load the owner-published timeback-alphatest-legacy-forms-v1 collection for the configured reviewer-bank/QTI tenant binding, validate its canonical sha256:<64 lowercase hex> manifest identity without rewriting it, read all 17 ordered artifactVersionIds from QTI, reconcile each owning artifactId and Content alias, and verify CASE/scoring/provenance. It returns aliases[17] in governed order with bankId:null, ownerMutationCount:0, and assignable:false: legacy import is an alias-proof operation and MUST NOT create a Content test_bank, bank_member rows, QTI artifacts, or any other owner mutation. The conformance assertion passes only when that exact immutable-deployment operation terminates ready with zero gaps and sanitized QTI/Content receipts. Public legacy admission remains fail-closed until its mode-specific positive receipt is explicitly published. Never regenerate, register, mutate, reduce the set, substitute local IDs, or treat a known ID list alone as authority. | #bank-itd-028 |
bank_list_endpoint_model | bank | /bank-operations lists generation and legacy-import operations with a kind discriminator. Bank/item discovery stays in Content/QTI. | #bank-axis-012 |
bank_membership_modes | bank | same_blueprint_fixed_forms creates ordered bank_member references with positive form_index; qti_adaptive_selection creates the Content bank but keeps selection/pool structure inside QTI and creates no fabricated fixed member list. | #bank-itd-009 |
bank_misconception_tagged_distractor_verification | bank | For every selected-response item, slot verification requires every incorrect response choice to carry a non-empty Incept-authored named misconception tag, requires each tag to be distinct from the correct response and traceable to the generated source artifact, and preserves the choice-to-misconception mapping through deterministic QTI conversion and Content/QTI read-back evidence. An untagged, dead, duplicated, or answer-key-conflicting distractor fails the slot and quarantines the item; Bank never invents or repairs misconception labels locally. Non-selected-response interactions record distractor verification as not_applicable with their interaction type rather than fabricating distractors. | #bank-itd-026 |
bank_owner_per_fact | bank | AlphaTest owns generation workflow state, deterministic Incept-JSON→QTI conversion code, slot-verification policy, and audit composition only. Incept owns generated source items; CASE owns standards; Content/QTI own specs, forms, banks, packages, keys, and scoring. | #bank-itd-001 |
bank_platform_native_ids | bank | Generation requests accept Content specId; generated-bank success returns Content bankId/formId, QTI packageId/artifactId/artifactVersionId, and CASE identifiers verbatim. Legacy alias-proof success instead returns exactly 17 ordered owner aliases with bankId:null, ownerMutationCount:0, and assignable:false. AlphaTest adds only operationId and proof metadata; known legacy UUIDs remain untrusted until tenant-aligned owner reads reconcile them. | #bank-itd-004 |
bank_privacy_retention | bank | Persist tenant-scoped operation metadata, upstream IDs, hashes, states, and audit evidence—never item bodies, keys, learner data, attempts, or mastery. Privileged deletion never cascades to Platform3. | #bank-axis-011 |
bank_qti_scoring_oracle | bank | For every converted item, submit the Incept expected response through a pseudonymous QTI delivery session and attempt; require the documented correct score and applied processing trace, then bind source hash, QTI version ID, input hash, outcome, and trace ID. | #bank-itd-007 |
bank_query_model | bank | Filter operations by status, kind, specId, bankId, and RFC3339 modifiedSince; sort createdAt/updatedAt; page by opaque cursor with bounded limit. | #bank-axis-003 |
bank_read_shape | bank | Expose operation list/detail and manifest subresource; bank/form bodies remain direct Platform3 reads through returned IDs. | #bank-axis-002 |
bank_real_upstream_calls | bank | Production operations and immutable conformance call the configured Incept, Content, QTI, and CASE origins at runtime and retain sanitized host, method, operation, status, native identity or hash, request/trace ID, and timestamp. Conformance binds the verified reviewer-bank caller tenant to the exact server-configured QTI platform tenant UUID; demo fixtures, copied owner data, and local mocks can never produce ready or a certification receipt. | #bank-itd-003 |
bank_slot_verification | bank | Admit an item only when primary CASE identity, DOK, requested interaction, QTI validation, Platform3 correct-response score, and provenance all pass. Quarantine failures by upstream reference; partial forms never join a bank. | #bank-itd-005 |
bank_tenant_routing | bank | Public paths have no tenant parameter. Derive the AlphaTest tenant only from the verified JWT; compatibility X-Timeback-Tenant must equal the claim or returns 403, and scope every local/upstream operation to it. Immutable conformance additionally requires server configuration that maps reviewer-bank to its exact QTI platform tenant UUID and signs that UUID into the deployment-host-bound envelope; the request cannot choose or override the mapping. Reads for a valid identifier owned by another tenant return the same RFC 7807 resource_not_found 404 shape as an unknown identifier. | #bank-axis-009 |
bank_weak_item_regeneration_rotation | bank | A reports-owned revision order naming a weak item and reason (non-discriminating, dead or untagged distractor, or miskeyed) starts a new idempotent Bank regeneration operation that requests a replacement from Incept for the same blueprint slot, runs the complete slot, misconception, QTI-conversion, scoring, and owner-read verification chain, and only then rotates the new immutable QTI artifactVersionId into Content-owned bank membership with provenance linking revisionOrderId, replacedArtifactVersionId, replacementArtifactVersionId, Incept generationRunId, and effectiveAt. The prior artifact remains owner-retained for audit and in-flight administrations; failed replacement verification leaves membership unchanged. Bank never edits the old item, authors a replacement locally, or recomputes Reports analytics. | #bank-itd-027 |
bank_wire_release_gate | bank | Certification and public admission are capability-specific, never global. Owner release certification SAME_BLUEPRINT_FIXED_FORMS-2026-07-21 is published with release_state=ready on the previously wire-verified basis: authenticated Incept artifacts since 2026-07-16, Content test_spec create/read/idempotent-replay conflict (platform3#787), QTI ingest/scoring, governed source catalog ITD-033 release_state=ready, conforming per-tenant three-slot credentials 7/7, and positive operation bop_5WX5F484ZYGMHC9K58VSEMD5PP. Public same_blueprint_fixed_forms creates are therefore admitted and return 202 after preflight. This certification cannot open qti_adaptive_selection or legacy import: each remains typed-424 fail-closed until its own current immutable-deployment ready/zero-gap receipt is explicitly published. The immutable conformance envelope itself MUST bind caller tenant reviewer-bank (33979ed1-36ac-4973-8b2e-181f311c0d5f) to the exact configured QTI_PLATFORM_TENANT_ID, use distinct server-held Content/QTI/CASE credentials with no PLATFORM3_JWT fallback, replay fixed, adaptive, and timeback-alphatest-legacy-forms-v1 all-17 operations on that same immutable hostname, require ready as the only passing terminal for all three, retain sanitized owner traces, and prove an owning-tenant 200 versus same-shape cross-tenant 404. Stable production-alias admission changes only after the relevant mode-specific certification receipt is recorded. | #bank-itd-016 |
bank_worker_checkpoints | bank | All operations begin admitted only after capability preflight. Generation advances through spec_resolved → standards_resolved → generated → converted → qti_ingested → scoring_proved → content_registered → membership_read_back → terminal. Legacy alias proof advances through owner_collection_read → all_versions_read → aliases_reconciled → scoring_proved → zero_mutation_asserted → terminal; content_registered and membership_read_back are invalid legacy phases. Restart generation by re-reading upstream identity/hash before replaying an idempotent child write; restart legacy only with owner reads and an assertion that ownerMutationCount remains zero. | #bank-itd-014 |
bank_write_granularity | bank | POST creates one generation or legacy-import operation after preflight; no public item-authoring or multi-bank atomic endpoint. | #bank-axis-001 |
blueprint_adaptive_deferred_window_and_release_certification | blueprint | Keep adaptive_diagnostic as one value of the required test_kind field and keep its CASE/KC pool target plus stopping-policy validation, but DEFER successful adaptive creation while the verified JWT tenant lacks a discoverable, owner-typed CASE knowledge-component corpus. During this deferred window, POST /v1/blueprints with test_kind=adaptive_diagnostic must return typed 422 adaptive-kc-corpus-not-onboarded, retryable=false, before operation creation, idempotency receipt, CASE request, Content write, or local working state; authenticated list/detail reads remain live Content-backed, anonymous and cross-tenant requests fail closed, and the public release-status surface links Platform3 issue #1138 and the dated adaptive-release-evidence.json. This deferred-window behavior is the complete certifiable contract for implementation@adaptive_diagnostic and is not a successful diagnostic release. Reopen implementation when independently observable upstream facts all hold for one exact tenant: CASE publishes a documented framework/package discovery or detail route returning 200 with stable identities, the corpus contains owner-typed adaptive-eligible Knowledge Components, and every selected KC dereferences at GET /ims/case/v1p1/CFItems/{id}. After reopening, but before declaring release, a separate certification must prove the exact documented AlphaTest POST returns 202, its relative Location reaches ready, the returned native Content test_spec carries the stopping_policy passing rule, the coverage route returns coverage-not-applicable, and sanitized CASE and Content traces prove real upstream calls. Failed post-reopen certification returns the cell to changes_requested; it does not make the reopen trigger circular. AlphaTest never relabels Standards as KCs, copies a CASE corpus, or fabricates a ready response. | ITD-041 |
blueprint_async_creation | blueprint | Blueprint creation is an asynchronous operation returning 202; operation state is queued, resolving, persisting, ready, or failed, and ready contains the native Content test_spec id. | ITD-002 |
blueprint_authoritative_source_assessment_input | blueprint | Each mastery_gate source_assessment_ref supplies content_test_spec_id and immutable content_version plus customer-facing name, jurisdiction, and assessment_version. AlphaTest reads GET /content/alpha/implementation/api/tenants/{tenantId}/alpha/content/items/{contentTestSpecId}/blueprint with the exact-tenant read:content credential and requires spec_id and version to match, assessment_role=spec, and kc_coverage to be the deployed nonempty JSON object keyed by source CASE GUID with values keyed only by dok1, dok2, dok3, and dok4 and positive integer item counts. Each positive {sourceCaseGuid,DOK,count} cell is one source requirement; the complete returned object is the exhaustive source-assessment manifest. AlphaTest reads each source and target at GET /ims/case/v1p1/CFItems/{id}. Mapping provenance is either identity with the same CASE GUID and item revision on both sides, or a real association read at GET /ims/case/v1p1/CFAssociations/{associationId} whose origin, destination, and revision match the working row; AlphaTest never fabricates an identity association. The union's unique-cell cardinality and total item count before mapping must equal those values after mapping, every cell must map exactly once, and every mapped slot's minimum DOK must be at least the source DOK. An omitted, duplicated, stale, unmapped, ambiguous, count-changing, or lower-DOK cell fails before any Content POST. Conformance fixtures include a complete source test_spec and mutations that omit one cell, lower one slot DOK, duplicate one mapping, or stale one CASE revision; each mutation asserts zero target test_spec writes. | ITD-030 |
blueprint_calibration_conformance_proof | blueprint | Release conformance includes an autonomous two-source calibration fixture and mutation suite. The positive fixture creates a mastery_gate whose governed source references each resolve to one 100-percent SourceCalibrationTarget, reaches ready, reads the Content item and passing_rule back, and proves exact source/version/target cardinality plus public BlueprintDetail and coverage projection parity. Negative creation mutations remove one target, duplicate one source target, change source or version identity, set target_value to 99.99, change the literal relation, or make an evidence ref non-dereferenceable; each must return the catalogued 422 and assert zero target Content writes. The delta fixture snapshots predecessor Content id/version, criteria, per-source targets, union KC×DOK cells, item counts, and coverage hash; applies one reports-signed delta; follows 202 to ready; and asserts a distinct immutable successor linked by supersedes, unchanged predecessor, preserved exhaustive source-cell cardinality and item counts, every mapping exactly once at target DOK greater than or equal to source DOK, all sources still at target 100, and before/after criteria, target, evidence, delta, and coverage hashes visible to Reports and public reads. Replaying the same Idempotency-Key, body, and delta_id must return the same successor with replay=true and no extra Content write; changed-body key reuse and changed-content delta reuse must return conflict, while stale base and skipped or repeated sequence must return stale, all with zero writes. The suite records sanitized Content, CASE, Results, and Analytics hosts, methods, statuses, native ids, trace ids, and timestamps; mocks or local fixtures cannot satisfy deployed conformance. | ITD-046 |
blueprint_calibration_evidence_release_gate | blueprint | governed-source-release.json schema version 3 is the executable source-and-calibration catalog. Each source entry contains the immutable tenant/source/Content identity plus exactly one owner-approved calibration object with calibration_target_id, literal equivalent_raw_score_percent target 100, relation mastery_implies_at_least, immutable calibration_policy_version, version-pinned scoring_policy_ref, approval principal and instant, and evidence bindings. Each binding names its native owner, immutable reference id, exact tenant-scoped dereference method and route, least-privilege server credential slot, expected source_key/content_test_spec_id/content_version_id/calibration_target_id tuple, and a sanitized 2xx receipt reference. Results uses GET ${PLATFORM3_RESULTS_BASE_URL}/alpha/results/v1/result-records/{resultRecordId} with PLATFORM3_RESULTS_CALIBRATION_READER_JWT; Analytics requires GET ${PLATFORM3_ANALYTICS_BASE_URL}/alpha/analytics/v1/calibration-artifacts/{artifactId} with PLATFORM3_ANALYTICS_CALIBRATION_READER_JWT. The current Analytics contract does not publish that calibration-artifact detail route, and neither source has an owner-approved native Results record or Analytics artifact bound to its exact source/version/target tuple. Therefore both entries are blocked_missing_source_bound_evidence and the catalog release_state is blocked_missing_calibration_evidence; POST for either formerly promoted fixture fails before operation creation or any local or Content write with 422 calibration-evidence-not-onboarded. Generic Results/Analytics 2xx rows, sandbox fixtures, public scoring pages, Content/CASE governance receipts, null ids, and route templates never satisfy a binding. Promotion to ready is atomic and occurs only after every required binding has a non-null native id, the owner route is published, an owner-approved policy record exists, and a fresh same-tenant probe returns 2xx whose response binds the exact four-part identity; the sanitized receipt records host, method, path template, status, native id, trace id, observed_at, response schema/version, binding fields and hashes, but no credential or learning fact. Exactly one target must derive for each source/version and zero targets may derive while any binding is incomplete. Reopen the demo mastery_gate quickstart and its 202-to-ready release claim only when all four source-owner pairs (STAAR×Results, STAAR×Analytics, Iowa×Results, Iowa×Analytics) pass that rule in one catalog revision and the deployed release smoke proves the exact catalog bytes were loaded. | ITD-048 |
blueprint_consistency_and_time | blueprint | Operation reads are read-after-write consistent, blueprint detail becomes visible only after Content persistence succeeds, and every timestamp is an RFC 3339 UTC instant with millisecond precision. | ITD-025 |
blueprint_content_compatible_list_query | blueprint | GET /v1/blueprints translates only to Content-published list parameters: content_kind=test_spec, limit, cursor, test_kind, subject_id, target_grade_id, status, and modifiedSince; it never sends sort because the live Content descriptor does not publish that parameter and rejects it. AlphaTest preserves Content's returned order and opaque cursor without local reordering or indexing. Client-selectable or forced created_at ordering is DEFERRED until the Content descriptor publishes a stable sort parameter and a live tenant-scoped probe returns 200 with cursor-stable ordering; unsupported AlphaTest query fields return 422 before the upstream call. | ITD-034 |
blueprint_content_detail_read_seam | blueprint | Blueprint detail reads the native Content item and seven-field test_spec sidecar; kc_coverage is the Content-owned KC/cognitive-level allocation, item_type_mix and difficulty_constraints carry the requested distribution constraints, passing_rule carries kind-specific criteria, and the three form fields carry parallel-form policy. AlphaTest joins only the version-pinned source test_spec cells from ITD-030 to its tenant-scoped crosswalk working artifact, emitting source assessment id and version, source standard CASE GUID, source required DOK, source item count, target CASE GUID, mapping kind and provenance, blueprint slot, required DOK, and source Content version. It revalidates source and target through GET /ims/case/v1p1/CFItems/{id} and any non-identity mapping through GET /ims/case/v1p1/CFAssociations/{id}. Before any Content POST, the operation fails unless the source union's unique KC×DOK cell cardinality and total item count are preserved, every cell maps exactly once, and every assigned slot DOK is greater than or equal to source DOK. The working artifact is evidence for the Content blueprint, never a second blueprint record. | ITD-027 |
blueprint_content_item_version_identity | blueprint | Each mastery_gate source_assessment_ref supplies source_key, content_test_spec_id, content_version, name, jurisdiction, and assessment_version exactly matching the caller-tenant entry in governed-source-release.json. The catalog additionally pins content_version_id to the immutable latest_version_id returned by GET /content/alpha/implementation/api/tenants/{tenantId}/alpha/content/items/{contentTestSpecId}; AlphaTest requires the item content_id and latest_version_id to match those pins, then separately requires the blueprint sidecar spec_id to match, assessment_role=spec, and kc_coverage to be a nonempty object of positive dok1–dok4 counts. The sidecar is not required to repeat a version field it does not own. AlphaTest re-reads the item after the sidecar and fails 503 source-assessment-unavailable with zero target Content writes if latest_version_id changed, so the two reads bracket one immutable coverage snapshot. It then verifies every source and target at GET /ims/case/v1p1/CFItems/{id}, every non-identity mapping at GET /ims/case/v1p1/CFAssociations/{associationId}, preserves unique KC×DOK cardinality and total item count, maps every cell exactly once, and requires target DOK greater than or equal to source DOK. | ITD-035 |
blueprint_content_service_auth | blueprint | Use the existing Platform3 static service-JWT format through the server-only PLATFORM3_TENANT_BINDINGS_JSON secret, keyed by exact verified AlphaTest tenantId. Each value is {version,notBefore,expiresAt,current,next}; current and optional next each contain separate contentReadJwt, contentAuthorJwt, and caseReadJwt values. Every JWT must decode to the key's tenantId, an unexpired exp, and exactly read:content, author:content, or case:read for its slot. Select only the binding keyed by the verified caller tenant, prefer next after its notBefore, require at least five minutes remaining, and never fall back to another tenant. Operators install next at least 24 hours before current expires, prove all three same-tenant calls, promote after at least 15 minutes of overlap, and retain still-valid current for rollback until promotion succeeds. Missing, malformed, expired, mismatched, or under-scoped bindings return one non-enumerating 503 tenant-binding-unavailable before any upstream call. AlphaTest never forwards the caller JWT, accepts upstream tokens from requests, calls a demo mint for a real tenant, logs a token or decoded claims, or holds one cross-tenant bearer. Release proves reviewer-blueprint and a second tenant independently, tenant A create/read/list plus CASE reads, bidirectional cross-tenant non-enumeration, wrong-slot least-privilege rejection, current-to-next rotation, expiry rejection, and zero token disclosure. | ITD-028 |
blueprint_content_write_seam | blueprint | Bind POST /v1/blueprints to POST /content/alpha/implementation/api/tenants/{tenantId}/alpha/content/items with content_kind=test_spec, Authorization, Content-Type, and Idempotency-Key; bind collection reads to GET that items route with content_kind=test_spec; and bind blueprint readback to GET /content/alpha/implementation/api/tenants/{tenantId}/alpha/content/items/{contentId}/blueprint. Map the Content response content_id/spec_id through unchanged. Content atomically owns the item, assessment_role=spec compatibility row, initial version, completed idempotency replay, and all seven native sidecar fields: kc_coverage, item_type_mix, difficulty_constraints, passing_rule, min_forms, max_item_overlap, and enemy_item_rule. Same-body replay must return the same id with Idempotency-Replayed=true; changed-body replay must return 409 content.idempotency_conflict. The descriptor is the discovery authority, but a stale derived boolean is not evidence that an explicitly enumerated route is absent. | ITD-026 |
blueprint_customer_and_reports_service_auth | blueprint | Every endpoint requires a verified Bearer JWT with sub, role, tenantId, iat, and exp, and tenantId remains the only tenant-routing source. Customer endpoints retain the bounded role matrix: reviewer and integrator have implicit blueprint:read and blueprint:write so both can replay the documented create contract in their own tenant; an optional scope claim can only narrow that role maximum; customer POST /v1/blueprints requires blueprint:write and customer GET routes require blueprint:read. POST /v1/blueprints/{contentTestSpecId}/calibration-deltas is the only reports service command: it requires role reports_service and explicit blueprint:calibration:write, grants no customer create/read right by implication, and rejects reviewer, integrator, missing-scope, wrong-tenant, expired, or anonymous tokens before idempotency or upstream access. No role grants student, roster, QTI, Results-record read, administrative, or cross-tenant permission through this API; the server uses separately held least-privilege upstream credentials to dereference only the evidence refs carried by an authorized delta. | ITD-047 |
blueprint_demo_release_reviewer_credential | blueprint | For the governed mastery_gate release fixture, AlphaTest operations issues a short-lived reviewer JWT out of band for tenant demo and places that token in the verification profile's mandated BLUEPRINT_PROD_REVIEWER_JWT environment variable, so the autonomous evaluator's existing credential path executes the exact ITD-036 demo release POST without tenant remapping. A separate BLUEPRINT_ISOLATION_REVIEWER_JWT is issued for tenant reviewer-blueprint and is used only for normal-tenant 422 behavior and bidirectional cross-tenant isolation probes. Both tokens have role reviewer, explicit blueprint:read and blueprint:write scopes, a maximum 15-minute lifetime, and no student, roster, QTI, Results, administrative, or cross-tenant authority. The operator-side mint uses PLATFORM_JWT_SIGNING_SECRET in the bounded driver or CI trust boundary; the secret and tokens are never exposed by an HTTP endpoint, committed, logged, embedded in evidence, or copied into the public site. Sanitized evaluator output records only issuer, tenantId, scopes, expiry, credential purpose, and credential_source=operator_out_of_band. The release fixture must return 202 with the demo credential; the isolation credential must return 422 source-assessment-not-onboarded with zero writes for the same source refs, and neither credential may read the other's working artifacts. Missing, expired, wrong-tenant, or over-scoped credentials fail the release cell; they never authorize tenant remapping, a public mint route, copied source records, or acceptance of 422 as release success. | ITD-042 |
blueprint_deterministic_allocation | blueprint | Normalized request plus immutable CASE source revisions and policy version deterministically produce ordered blueprint slots, distributions, and criteria. | ITD-005 |
blueprint_executable_governed_source_release | blueprint | Publish governed-source-release.json as the only executable source-assessment catalog. Its current release_state is blocked_missing_owner_records and source_assessments is empty because exact-tenant live Content inspection found no authoritative grade-5 TX mathematics source test_spec and no independently governed grade-5 comparison source test_spec; labels and the one-KC AlphaTest wire-certification draft are explicitly non-authoritative. Promotion to ready requires, in one reviewed change, two distinct owner-published Content test_specs with source_key, content_test_spec_id, immutable content_version, name, jurisdiction_or_publisher, assessment_version, subject, grade_range, applicability, approval, and evidence; evidence must record repeatable 200 Content readback, matching spec_id/version and assessment_role=spec, a nonempty exhaustive KC×DOK grid, and 200 CASE CFItem reads for every KC plus CFAssociation reads for every non-identity mapping. Until promotion, grade-5 TX mastery_gate examples are non-runnable and POST returns 422 source-assessment-not-onboarded before operation creation or any local/upstream write. After promotion, the deployed smoke must build its request from the exact two catalog entries and require 202, operation ready, Content detail/list readback, complete coverage, and live Content/CASE traces; a conditional smoke that treats the blocked 422 as customer success is forbidden. | ITD-033 |
blueprint_executable_slots | blueprint | Every slot carries CASE GUIDs, required minimum DOK, count, allowed QTI interaction types, and rationale; aggregate distributions must reconcile exactly to requested item count and time budget. | ITD-018 |
blueprint_fail_closed_superset | blueprint | A mastery_gate reaches ready only when every source standard is mapped to at least one blueprint slot at equal-or-higher DOK with provenance; any uncovered or unverifiable row fails the operation. | ITD-004 |
blueprint_governed_source_catalog_onboarding | blueprint | The AlphaTest testing director owns a version-controlled onboarding manifest that references, but never copies, governed Platform3 Content source-assessment test_specs for TX, FL, AZ, CA, MA, CCSS, NGSS, NAEP, C3, SAT, ISEE, AP, Core Knowledge, Stanford 10, and Iowa. Each manifest entry contains source_key, customer-facing name, jurisdiction or publisher, assessment_version, content_test_spec_id, immutable content_version, applicable subject and grade range, and approval provenance. Publication requires the exact-tenant Content read and CASE probes from ITD-030, a nonempty KC×DOK grid, immutable-version match, and testing-director approval; only approved entries may be accepted as source_assessment_refs. The first release fixture is a governed grade 5 TX mathematics source spec plus at least one independently governed comparison source. Missing coverage for a requested named source returns 422 source-assessment-not-onboarded before operation creation and names only the missing source_key; stale or unreadable approved entries fail the operation with 503 source-assessment-unavailable and zero target Content writes. If Platform3 lacks a source test_spec or cannot preserve its immutable version, AlphaTest files an upstream Content issue and keeps that source unapproved; it never synthesizes the source spec or infers it from CASE. | ITD-032 |
blueprint_idempotent_create | blueprint | Idempotency-Key is required on POST, scoped to tenant plus route, retained 24 hours, and rejects key reuse with a different canonical body. | ITD-010 |
blueprint_immutable_ready_specs | blueprint | Ready blueprints are immutable; corrections create a new blueprint linked by supersedes; GET responses emit ETag and honor If-None-Match. | ITD-009 |
blueprint_jwt_tenant_routing | blueprint | tenantId comes only from the verified JWT; tenant selection in URL, query, body, or header is rejected and every working-artifact query is tenant scoped. | ITD-014 |
blueprint_kind_specific_validation | blueprint | mastery_gate requires source_assessment_refs containing 1–50 unique immutable Platform3 Content test_spec ids and versions, complete union coverage from those records, highest-rigor policy, and binary mastery criteria. formative requires a bounded unit standard set and immediate per-standard criteria. Keep adaptive_diagnostic as one value of the same required test_kind field and require its CASE/KC pool target plus stopping-policy reference, but DEFER adaptive_diagnostic creation, runnable success examples, and release certification because the dated exact-tenant CASE probe returned 200 with 100 CFItems and zero items typed Knowledge Component, GET /ims/case/v1p1/CFPackages?limit=100 returned 405, and the known Grade 5 package detail returned Standards without a package identity. Until the release trigger occurs, POST with test_kind=adaptive_diagnostic fails before operation creation or any Content write with typed 422 adaptive-kc-corpus-not-onboarded, retryable=false, and a link to Platform3 issue #1138; AlphaTest never relabels Standards as KCs, copies a CASE corpus, or fabricates a ready response. Reopen only when Platform3 CASE publishes an exact-tenant framework or package containing at least one owner-typed adaptive-eligible Knowledge Component, a documented collection or detail request returns 200 with stable framework/package and CFItem identities, every returned KC dereferences through GET /ims/case/v1p1/CFItems/{id}, and the exact documented AlphaTest request reaches 202, ready, and native Content test_spec readback with sanitized CASE and Content traces. | ITD-039 |
blueprint_kind_specific_validation_superseded | blueprint | mastery_gate requires source_assessment_refs containing 1–50 unique immutable Platform3 Content test_spec ids and versions, complete union coverage from those records, highest-rigor policy, and binary mastery criteria; adaptive_diagnostic requires a CASE/KC pool target and stopping-policy reference; formative requires a bounded unit standard set and immediate per-standard criteria. | ITD-017 |
blueprint_no_cancel_or_delete | blueprint | v1 exposes neither operation cancellation nor blueprint deletion; reopen cancellation when a registered integrator has a reproducible erroneous request that remains nonterminal for more than five minutes, and deletion remains governed by upstream Content policy. | ITD-023 |
blueprint_owner_approved_public_inventory_bindings | blueprint | governed-source-release.json schema version 6 publishes manifest alphatest-public-inventory-bindings-2026-07-24.v2, authorized by the independently captured alphatest-spec-owner promotion event triage decision 2026-07-17-033 (GitHub Issue 45, created 2026-07-17T13:09:14Z), not by this build run. It binds all four STAAR public reporting-category rows to all twelve positive STAAR Content KC×DOK cells and all five Iowa public-domain rows to all eight positive Iowa Content KC×DOK cells. Each of the twenty bindings has a unique binding-authority-record.json locator that names the public owner URL and page/category locator, the exact Content test_spec and immutable version, and a dated 200 Platform3 CASE read with CASE GUID, human coding scheme, full statement, owner last-change instant, source DOK, and positive cell count; the manifest never cites itself as evidence. Validation requires 9/9 public rows, 20/20 positive cells exactly once, 20 unique external evidence locators, 20/20 binding identities live-read from Content and CASE, unique-cell cardinality 20 before and after, and total source item count 52 before and after. Missing-row, duplicate-cell, stale-version, unknown-row, count-drift, circular-or-missing evidence, inferred authority, and lower-target-DOK mutations each fail with typed 503 public-inventory-binding-unavailable before operation creation, local working state, or target Content write. This decision supersedes ITD-052's empty-manifest state; the manifest gate is ready, but the catalog remains blocked_pending_reviewer_credential_preflight until the separate ITD-055 evaluator-visible credential gate passes in the same release revision. | ITD-054 |
blueprint_path_versioning | blueprint | The API is path-versioned at /v1; additive fields may appear, enum expansion is announced, and removals or semantic changes require a new major path with a published overlap window. | ITD-020 |
blueprint_pending_release_reviewer_credential | blueprint | The verification profile's BLUEPRINT_PROD_REVIEWER_JWT and BLUEPRINT_ISOLATION_REVIEWER_JWT slots remain the only permitted out-of-band reviewer credential paths, with the same 15-minute maximum lifetime, least-privilege blueprint scopes, secret-handling rules, and tenant isolation requirements formerly pinned by ITD-042. They are reserved inputs, not evidence that the mastery-gate quickstart is released. While ITD-048 reports blocked_missing_calibration_evidence, release certification must assert the exact governed create request returns 422 calibration-evidence-not-onboarded before operation or writes for both credentials as applicable; no evaluator may require, accept, document, or regression-test 202-to-ready. The positive demo credential is minted and the 202-to-ready smoke is enabled only in the same deployment revision that loads a catalog with 4/4 approved source-owner bindings and after a preflight proves the exact deployed catalog hash and release_state=ready. The isolation credential then proves the unchanged wrong-tenant 422 and bidirectional non-enumeration. Missing credentials make only credential-dependent isolation evidence inconclusive; they cannot change catalog state or authorize a public mint route, tenant remap, copied source record, or fabricated release. | ITD-049 |
blueprint_per_source_perfect_score_calibration | blueprint | For every mastery_gate source_assessment_ref, AlphaTest derives exactly one SourceCalibrationTarget from the exact-tenant governed source catalog; callers continue to supply only the approved six-field source reference and cannot assert or override calibration. The target has stable calibration_target_id cal:{source_key}:{assessment_version}:{calibration_policy_version}, source_key, source content_test_spec_id and content_version_id, metric equivalent_raw_score_percent, target_value 100, relation mastery_implies_at_least, calibration_policy_version, scoring_policy_ref, evidence_refs, approved_at, and approved_by. The semantics are literal: a student satisfying the resulting blueprint's complete coverage and mastery criteria is calibrated to earn 100 percent of available raw-score points under the named source assessment's version-pinned scoring policy; a percentile, projected pass, confidence-only threshold, or less-than-100 target is invalid. Evidence refs are native, tenant-scoped Results result_record or Analytics artifact references plus the version-pinned scoring-policy evidence; AlphaTest dereferences them at generation time and stores no score, attempt, or mastery fact. Content remains the record of truth: passing_rule stores minimumPercent, requiredStandardPercent, calibrationPolicyVersion, and sourceCalibrationTargets; each target is projected unchanged as criteria.sourceCalibrationTargets on BlueprintDetail and as calibration.target plus calibration.status on the matching coverage source. Creation fails before any Content write with typed 422 calibration-target-missing, calibration-target-ambiguous, calibration-target-invalid, or calibration-evidence-invalid when the source-reference set and target set do not have exact one-to-one source/version identity, a target is not 100 with the literal relation, or an evidence reference is absent/not found. A published upstream schema mismatch returns 424 upstream-contract-mismatch; unavailable Results, Analytics, Content, or CASE returns retryable 503 calibration-evidence-unavailable. No failure may write Content, and the final DOK and mastery criteria must satisfy both the target and the fail-closed superset invariant. | ITD-044 |
blueprint_platform_native_ids | blueprint | Public blueprint ids are Platform3 Content test_spec ids, standards are CASE GUIDs, and AlphaTest operation ids are opaque UUIDs used only for orchestration. | ITD-019 |
blueprint_poll_eventing | blueprint | v1 uses operation polling plus modifiedSince list synchronization; webhooks reopen when a registered integrator demonstrates polling prevents completion of an assignment workflow or exceeds a documented rate budget. | ITD-012 |
blueprint_portable_reviewer_credential_bootstrap | blueprint | The repository publishes a bounded operator bootstrap and preflight contract that atomically mints BLUEPRINT_PROD_REVIEWER_JWT for tenant demo and BLUEPRINT_ISOLATION_REVIEWER_JWT for tenant reviewer-blueprint from the server-only PLATFORM_JWT_SIGNING_SECRET. Each JWT has iss=alphatest-loop, aud=alphatest-blueprint-reviewer, a nonempty sub, role=reviewer, scopes exactly [blueprint:read, blueprint:write], a unique jti, iat at mint time, and exp=iat+600 seconds. The preflight verifies both signatures and exact claims, current validity, lifetime between 1 and 900 seconds, distinct jti and token hashes, and writes only a sanitized receipt. The bootstrap is successful only when it exports both values to the same bounded driver environment before doer, deploy smoke, customer eval, and rubric eval; minting inside one smoke process or writing tokens to an artifact is failure. The release catalog advances from blocked_pending_reviewer_credential_preflight to ready only when that evaluator-visible preflight and the ITD-054 20/20 manifest validation pass against the identical catalog hash in one deployment revision. | ITD-055 |
blueprint_problem_details | blueprint | All non-2xx responses use application/problem+json following RFC 9457, stable HTTPS type URIs, request_id, and field-level errors where applicable. Authentication and authorization resolve first; a syntactically valid tenant-scoped operation id absent from AlphaTest returns the catalogued 404 operation-not-found without consulting Content; 424 upstream-contract-mismatch is reserved for a required published upstream response that violates its pinned schema, while missing server credentials or unavailable upstreams return retryable 503 upstream-unavailable. | ITD-013 |
blueprint_product_origin_mount_safe_operations | blueprint | The canonical customer origin is the one-product master origin. It serves the architecture, data dictionary, and customer website at their driver-recorded cell paths and mounts each deployed Blueprint API at /blueprint/integrator_api/implementation@{test_kind}/api; the immutable module deployment serves an API landing page at / and authenticated API routes at /v1 but does not duplicate or claim /architecture or /reference. POST /v1/blueprints returns 202 with Location: ./operations/{operationId} and an identical relative reference in operation.href. Both references are resolved against the effective POST URL, so they produce /v1/operations/{operationId} at the module origin and remain under /blueprint/integrator_api/implementation@{test_kind}/api/v1/operations/{operationId} at the path-mounted canonical origin. Clients follow the returned reference and must not construct a root-absolute /v1 URL. Deployment smoke must exercise POST then follow Location at both origins, require the documented operation response rather than a platform 404, verify the three master-origin documentation cell URLs return byte-matched committed artifacts, verify the module origin /architecture and /reference return 404, and fail on SSO, cross-kind rewrite collision, or an escaped mount. | ITD-040 |
blueprint_public_composed_origin | blueprint | SHIP one driver-recorded public HTTPS module origin where unauthenticated GET / serves the customer website, GET /architecture serves this decision record, GET /reference serves the data dictionary, and authenticated /v1 routes serve the Blueprint API; every later deliverable bundle preserves all four route classes. Deployment smoke must fail on a Vercel SSO redirect, protected immutable URL, documentation 404, API-to-documentation rewrite collision, asset failure, or bytes that do not match the committed artifacts. When a master route is protected, the verified public module production alias is canonical. | ITD-029 |
blueprint_public_inventory_binding_release_gate | blueprint | governed-source-release.json schema version 5 keeps the operator-approved STAAR Grade 5 Mathematics 2024 and Iowa Mathematics Level 11 public inventories but blocks creation until their nine public rows are authoritatively and exhaustively bound to the positive Content source KC×DOK cells. Each PublicInventoryCellBinding is owner-approved and version-pinned and contains source_key, public_row_code, source content_test_spec_id and content_version_id, source_case_guid, source_dok, source_cell_count, binding_authority, binding_authority_version, approved_by, approved_at, and evidence_ref. The authority must be either an explicit association returned by a pinned owner endpoint/query or a testing-director-approved binding manifest; labels, reporting-category similarity, CASE item text, Content kc_coverage alone, and inferred domain alignment are forbidden. Validation proves every governed public row appears at least once, every positive Content KC×DOK cell appears exactly once, no binding names an absent row or cell, each bound count equals the Content cell count, and the pre-binding and post-binding unique-cell cardinality and total item count are identical. Positive conformance uses the exact published manifest; mutation cases remove a public row, duplicate a cell, alter a count, change a CASE GUID or DOK, add an unknown row, and change the pinned Content version, and every mutation must return typed 503 public-inventory-binding-unavailable before operation creation, local working state, or Content write. The current catalog contains zero owner-approved bindings because neither approved Content KC coverage nor CASE CFItem detail publishes the public reporting-category/domain association and no owner binding manifest has been supplied; therefore release_state is blocked_missing_public_inventory_bindings and the formerly advertised 202 quickstart is withdrawn. Reopen atomically only when all nine rows and all twenty positive Content cells pass the count-preserving manifest check in one catalog revision, then require deployed positive and mutation evidence before restoring 202. | ITD-052 |
blueprint_query_model | blueprint | GET /v1/blueprints supports test_kind, subject, grade, status, modifiedSince, created_at descending order, opaque cursor pagination, and page_size 1–100 default 25, translated to one tenant-scoped Content test_spec list call. | ITD-008 |
blueprint_read_shape | blueprint | Ship blueprint list, blueprint detail, coverage subresource, and operation detail. Slots, standards, distributions, and policy remain embedded; no extra collections or local remembered-id index exist. | ITD-007 |
blueprint_released_demo_reviewer_credential | blueprint | The verification profile's BLUEPRINT_PROD_REVIEWER_JWT and BLUEPRINT_ISOLATION_REVIEWER_JWT slots are the only permitted out-of-band reviewer credential paths, each with a maximum 15-minute lifetime, least-privilege blueprint scopes, and verified tenant claims. In the same deployment revision that loads the byte-verified schema-v4 ready catalog, the demo credential must execute the exact two-source grade-5 TX mastery_gate request and require 202, follow the relative Location to ready, read back the native Content test_spec, and require a coverage row for every catalog tested-standard entry including each sourceDok=unstated row and its max-supported-DOK disposition. The isolation credential must prove wrong-tenant 422 and bidirectional non-enumeration. A missing credential makes only credential-dependent deployed evidence inconclusive; it cannot authorize a public mint route, tenant remap, environment override, copied source record, or a conditional test that accepts both 202 and 422. Any catalog hash mismatch, missing standard row, upstream failure, or proof failure blocks ready and records zero target Content writes. | ITD-051 |
blueprint_reports_calibration_delta_revision | blueprint | Reports submits calibration feedback to POST /v1/blueprints/{contentTestSpecId}/calibration-deltas with a required Idempotency-Key and a signed, unexpired same-tenant service JWT carrying role reports_service and blueprint:calibration:write; integrator and reviewer roles cannot call it. This is the single service-command exception to the customer-role matrix superseded by ITD-047. The body contains delta_id, calibration_target_id, source_key, base_content_version_id, sequence, generated_at, analytics_artifact_ref, result_record_refs, external_score_evidence_refs, analysis_policy_version, reason_codes, and proposed_changes containing only minimumPercent, requiredStandardPercent, or minimum_dok_by_case_guid. AlphaTest first dereferences the native Results/Analytics evidence under least-privilege server credentials, verifies every reference and source/tenant/version binding, then acquires a tenant+blueprint revision lock and requires base_content_version_id to equal the current immutable version and sequence to be exactly the next value for that blueprint/source. The same idempotency key plus canonical body replays the same operation and successor; key reuse with a different body or delta_id with different content returns 409 calibration-delta-conflict, and an old base or sequence returns 409 calibration-delta-stale with current_version_id and next_sequence but no cross-tenant fact. Deterministic application may raise or lower a proposed threshold only when the resulting criteria still satisfy every per-source perfect-score target and the exhaustive equal-or-higher-DOK coverage invariant; otherwise it returns 422 calibration-delta-would-weaken-proof with zero Content writes. Success returns 202 and an operation that creates a new immutable Content test_spec identity and version through the existing Content create seam, copies no attempt data, links supersedes to the prior blueprint, records applied_delta_id and before/after criteria plus evidence references in Content passing_rule, and leaves the prior record unchanged. Ready returns predecessor and successor Content ids/versions, calibration target id, applied sequence, before/after criteria hashes, coverage proof hash, evidence refs, Content trace id, and replay status so Reports can retain the revision receipt. AlphaTest keeps only the normal bounded idempotency/revision working metadata and 30-day audit composition; Results and Analytics remain the durable owners of outcome and calibration evidence. | ITD-045 |
blueprint_reviewer_credential_bootstrap_release_gate | blueprint | The bounded driver or CI bootstrap must populate BLUEPRINT_PROD_REVIEWER_JWT with an operator-signed JWT whose exact claims are tenantId=demo, role=reviewer, scopes equal to blueprint:read and blueprint:write with no extras, and exp-iat between 1 and 900 seconds; it must separately populate BLUEPRINT_ISOLATION_REVIEWER_JWT with tenantId=reviewer-blueprint, the same exact role/scopes/lifetime bounds, and a distinct jti or token hash. Before doer, deployed smoke, customer eval, or rubric eval starts, a credential preflight decodes both tokens without logging them, validates signature, issuer, audience, sub, role, tenant, exact scopes, iat, exp, distinctness, and current validity, and writes only a sanitized receipt with claims, lifetime, credential purpose, and pass/fail. Failure stops credential-dependent success evaluation and keeps release_state blocked; the API never remaps tenants, broadens roles, accepts the generic year-long reviewer token, mints through HTTP, or substitutes an internal smoke-only token for the environment value the independent evaluator reads. The observed 2026-07-24 environment fails this gate: BLUEPRINT_PROD_REVIEWER_JWT has tenantId=reviewer-blueprint, no scopes, and a 31,536,000-second lifetime, while BLUEPRINT_ISOLATION_REVIEWER_JWT is absent. Reopen the reviewer proof only after one bootstrap run supplies both conforming tokens before all four consumers and the sanitized receipt plus bidirectional anonymous/cross-tenant probes pass in the same deployment revision. | ITD-053 |
blueprint_safe_observability | blueprint | Structured logs carry request_id, tenant-safe hashes, operation id, upstream host, latency, and status but never JWTs, source documents, student data, or upstream credentials; service credentials remain server-side. | ITD-022 |
blueprint_scoped_jwt_auth | blueprint | Every endpoint requires a verified Bearer JWT with sub, role, tenantId, iat, and exp. Roles reviewer and integrator have implicit blueprint:read and blueprint:write because both must replay the documented create contract inside their own tenant; an optional scope claim can only narrow that role maximum. POST requires blueprint:write, every GET requires blueprint:read, and neither role grants any student, roster, QTI, Results, or cross-tenant permission. | ITD-011 |
blueprint_single_write_granularity | blueprint | Ship one-blueprint POST backed by one atomic Content test_spec create; do not expose client update or delete. Bulk create is DEFERRED until one registered integrator must atomically commission at least 25 blueprints in one job. | ITD-006 |
blueprint_systems_of_record | blueprint | Platform3 Content test_spec is the blueprint of record; CASE is the standards authority; AlphaTest stores only tenant-scoped crosswalk work and evidence references. | ITD-001 |
blueprint_tenant_credential_provisioning | blueprint | Platform3 tenant onboarding owns minting the three exact-tenant service JWTs required by ITD-028. Before AlphaTest enables any blueprint route for a tenant, a Platform3 operator must deliver the current bundle through the approved server-secret channel, record issuer, tenantId, exact scope, issued-at, expiry, and rotation owner in a non-secret attestation, and pass automated probes for Content list/read, Content author create/readback, and CASE read using only the matching slot. AlphaTest operations installs the attested bundle into PLATFORM3_TENANT_BINDINGS_JSON, verifies the attestation hash against the installed JWT claims without logging tokens, and records gate status per tenant. The reviewer-blueprint tenant and one isolation tenant are mandatory release fixtures. If Platform3 cannot mint any required slot, AlphaTest files an upstream Platform3 issue naming the missing scope and probe, marks the tenant credential gate blocked, releases no success example for that tenant, and returns retryable 503 tenant-binding-unavailable; it does not mint, broaden, forward, or demo-remap a credential. | ITD-031 |
blueprint_tenant_scoped_governed_source_promotion | blueprint | governed-source-release.json remains the only executable catalog and is promoted to release_state ready for tenant demo with the operator-approved staar-math-g5-v2024 and iowa-math-g5-l11 entries from alphatest#45. Each entry pins tenant_id, the six public reference fields, content_version_id, subject and grade applicability, approval provenance, and dated Content/CASE evidence. Production reads this checked-in catalog in every NODE_ENV; GOVERNED_SOURCE_CATALOG_JSON is only a byte-equivalent deployment mirror and cannot override it. A request is approved only when its exact six-field reference matches an entry whose tenant_id equals the verified JWT tenant and whose ITD-035 wire checks pass. The demo release smoke must build the exact two-entry request and require 202, ready, Content detail/list readback, complete equal-or-higher-DOK coverage, and Content/CASE traces; 422 is never success for that fixture. Other tenants return 422 source-assessment-not-onboarded with zero writes until Platform3 Content publishes the same governed source records in that exact tenant and a reviewed catalog change records their distinct version ids and evidence. Reopen global catalog portability only when Content publishes an owner-defined cross-tenant source reference or replication contract and two tenant probes resolve one governed source without AlphaTest copying it. | ITD-036 |
blueprint_test_kind_selector | blueprint | A required test_kind selects mastery_gate, adaptive_diagnostic, or formative within one blueprint resource and one lifecycle. | ITD-003 |
blueprint_three_kind_validation_and_adaptive_release | blueprint | mastery_gate requires source_assessment_refs containing 1–50 unique immutable Platform3 Content test_spec ids and versions, complete union coverage from those records, highest-rigor policy, and binary mastery criteria. formative requires a bounded unit standard set and immediate per-standard criteria. adaptive_diagnostic remains one value of the same required test_kind field and requires a CASE/KC pool target plus stopping-policy reference, but successful adaptive creation is DEFERRED while the verified JWT tenant lacks a discoverable, owner-typed CASE knowledge-component corpus. During that deferred window, adaptive POST returns typed 422 adaptive-kc-corpus-not-onboarded, retryable=false, before operation creation, idempotency receipt, CASE request, Content write, or local working state; authenticated list/detail reads remain live Content-backed, anonymous and cross-tenant requests fail closed, and the release-status surface links Platform3 issue #1138 and the dated evidence. Reopen adaptive implementation only when independently observable upstream facts all hold for one exact tenant: CASE publishes a documented framework/package discovery or detail route returning 200 with stable identities, the corpus contains owner-typed adaptive-eligible Knowledge Components, and every selected KC dereferences at GET /ims/case/v1p1/CFItems/{id}. After reopening, a separate release certification must prove the documented POST returns 202, its relative Location reaches ready, the native Content test_spec carries the stopping_policy passing rule, coverage returns coverage-not-applicable, and sanitized CASE and Content traces prove real upstream calls. Failed post-reopen certification returns the cell to changes_requested and never relabels Standards as KCs, copies a CASE corpus, or fabricates success. All three kinds use the same blueprint resource and operation lifecycle; no kind is a separate product. | ITD-043 |
blueprint_traffic_bounds | blueprint | Enforce an exact deploy-wide limit of 120 reads per tenant per trailing 60 seconds through blueprint-owned Postgres table blueprint_rate_limit_events(tenant_id_hash, route_class, occurred_at, request_id), primary key request_id, and index (tenant_id_hash, route_class, occurred_at). A SECURITY DEFINER consume_blueprint_read_quota function takes a transaction-scoped advisory lock for tenant+route, deletes rows older than 120 seconds, counts the trailing 60 seconds, and atomically inserts or rejects. RLS is enabled; anon/authenticated grants are revoked; only the server service role executes it. The idempotent migration and execute grant are deployment prerequisites: startup must successfully probe consume_blueprint_read_quota before any blueprint read route is released. Limiter absence or failure returns 503, never fail-open. Rejection returns 429 with integer Retry-After computed from the oldest in-window event. Also limit each tenant to five nonterminal operations and reject JSON above 256 KiB. | ITD-024 |
blueprint_two_stage_calibration_release | blueprint | governed-source-release.json schema version 4 separates initial policy calibration from post-administration empirical calibration. Initial mastery-gate creation requires, per exact tenant/source/Content version, an operator-approved and version-pinned public source/scoring-policy record, a literal equivalent_raw_score_percent target_value 100 with relation mastery_implies_at_least, the ITD-035 Content/CASE wire evidence, and an exhaustive published tested-standard inventory whose every row has a stable source code, reporting category or domain, evidence locator, DOK value or the literal value unstated, and runtime mapping disposition. Unstated source DOK is never guessed: the generated coverage row remains visibly sourceDok=unstated and can pass only when the target slot uses the highest supported DOK and the coverage proof records policy=max_supported_due_to_unstated_source_dok. Results result_record and Analytics calibration-artifact bindings are not creation prerequisites because those facts arise only after administration; requiring them before the first blueprint is circular. They remain mandatory inputs to ITD-045 calibration-delta revisions, which dereference native records and create an immutable Content successor without copying outcomes. The operator-approved STAAR Grade 5 Mathematics 2024 and Iowa Mathematics Level 11 records therefore release atomically for tenant demo when the checked-in catalog, its public-source evidence, and the dated Content/CASE evidence all validate; POST of their exact six-field references returns 202, reaches ready only after exhaustive equal-or-higher-DOK proof, and persists the literal targets in Content passing_rule. A missing inventory row, evidence locator, Content/CASE identity, target, or mapping disposition fails closed before Content write. Reopen empirical release gating for initial creation only if a published source owner makes a pre-administration calibration artifact an explicit prerequisite and two independent source programs supply it before any administration. | ITD-050 |
blueprint_upstream_conformance | blueprint | Readiness requires trace evidence naming the configured CASE and Content hosts, request correlation ids, resource ids, and successful response classes; local mocks cannot satisfy deployed conformance. | ITD-015 |
blueprint_upstream_failure_policy | blueprint | Retry transient CASE and Content failures with bounded exponential backoff; terminal operations expose upstream_unavailable without substituting cached or local data, and safe client retry uses the original idempotency key. | ITD-021 |
blueprint_wire_faithful_read_projections | blueprint | GET /v1/blueprints returns a BlueprintPage of wire-faithful BlueprintSummary records projected only from each Content list item: content_test_spec_id, title, subject, grade, status, latest_version_id, updated_at, and links, plus Content's opaque next_cursor. It never requires detail-only test_kind, scope, item_count, time_budget_minutes, rigor_policy, slots, distributions, policy_version, or supersedes fields and never returns 424 merely because those fields are absent from the collection response. GET /v1/blueprints/{id} composes the Content item and seven-field test_spec sidecar into BlueprintDetail; test_kind and kind-specific criteria must be encoded inside Content-owned passing_rule at create time, KC allocation comes from kc_coverage, interaction and rigor constraints come from item_type_mix and difficulty_constraints, and parallel-form policy comes from min_forms, max_item_overlap, and enemy_item_rule. GET /coverage joins that Content-owned detail to AlphaTest's permitted tenant-scoped crosswalk evidence while retained. Fields with no owner-published source are absent rather than synthesized. A published Content response that omits a field this projection actually requires is 424 upstream-contract-mismatch. | ITD-037 |
blueprint_wire_verified_list_filters | blueprint | GET /v1/blueprints accepts only limit, cursor, subject_id, target_grade_id, and modifiedSince. It sends content_kind=test_spec, passes limit, cursor, subject_id, and target_grade_id unchanged, and passes the camelCase modifiedSince name through verbatim in one tenant-scoped Content call. The live endpoint-list-content-items descriptor publishes subject_id, target_grade_id, modifiedSince, test_type, and is_mastery_gate; dated exact-tenant probes returned 200 for subject_id, target_grade_id, modifiedSince, and is_mastery_gate=true, but returned 400 for test_kind, status, test_type, modified_since, and sort. AlphaTest therefore DEFERs public test_kind and status list filters rather than scan, synthesize, or expose mastery_gate-only semantics for a three-kind field. Reopen test_kind only when Content supports all three AlphaTest values in one published parameter and live probes return 200 for mastery_gate, adaptive_diagnostic, and formative; reopen status only when Content publishes it and live probes return 200 for every documented status. Explicit sort remains DEFERRED until Content publishes a stable sort parameter and a live probe proves cursor-stable ordering. Any unsupported AlphaTest query field returns 422 before Content; any published filter later rejected on the wire returns non-retryable 424 upstream-contract-mismatch, records the failing probe, files an upstream issue, and blocks release. | ITD-038 |
blueprint_working_artifact_retention | blueprint | AlphaTest retains tenant-scoped crosswalk working artifacts for 30 days after terminal state, then deletes them; blueprint records and standards follow Content and CASE retention, and no student data enters this module. | ITD-016 |
bounded_score_recovery_simulation | mastery_engine | POST runs a bounded deterministic synthetic profile matrix synchronously and returns recovery errors, tolerance verdict, content hashes, and a Caliper eventIri/envelope hash read-back as the immutable evidence receipt. | ITD-021 |
bounded_upstream_orchestration | mastery_engine | advance makes bounded parallel reads, then serialized QTI/write operations; published SLOs measure p95 excluding upstream time and end-to-end including it separately. Every upstream call has deadline, retry class, and correlation ID. | ITD-022 |
constrained_information_gain_selection | mastery_engine | filter by blueprint/CASE coverage, accessibility, exposure, prior use, and pool eligibility; choose maximum expected posterior entropy reduction; stable QTI ID breaks ties. Policy pins coverage floors, precision, classification, max-item, and time rules. | ITD-015 |
deterministic_canonical_response_replay | mastery_engine | Filter QTI runtime data to token-named sessions; order by token offer sequence, attemptNumber, then attemptId; canonicalize numbers; reject conflicts; pin policy/calibration, Content identity hash, QTI root artifactVersionId/ETag, ordered resolved member-version/CASE/KC hash, CASE mapping, runtime versions, and stable tie-breaking. | ITD-016 |
mastery_api_versioning | mastery_engine | /v1 path version; policy/calibration IDs are immutable versions; response additions are compatible; enum consumers must tolerate unknown values; removals/semantic changes require /v2 and migration window. | ITD-020 |
mastery_completion_acknowledgements | mastery_engine | production_learner completed means every token-named QTI item attempt is submitted and scored, Results acknowledges the result_record and every per-KC component, and Caliper completion is read back; owner_conformance completed is explicitly synthetic and requires the same QTI scoring plus Caliper conformance read-back but creates no learner Results fact. Neither status claims QTI delivery sessions are closed. | ITD-019 |
mastery_conformance_evidence | mastery_engine | publish an OpenAPI contract suite; replay golden streams across process restarts; probe anonymous/cross-tenant access; capture upstream host/operation/request IDs; run known-mastery simulations with calibration-specific tolerance. | ITD-011 |
mastery_end_to_end_acceptance_trace | mastery_engine | The release receipt is one redacted tenant-scoped trace, not a health check: Content blueprint plus adaptive-bank identity/rule with zero members; QTI immutable root read plus complete member-version/CASE/KC resolution and stable repeat hash; QTI delivery-session create and scored-runtime reads; CASE and NWEA anchor reads; deterministic stop with replay hash; for production_learner, Results result_record plus one acknowledged component per CASE GUID; Caliper POST plus read-back; and a final AlphaTest 200/201 containing scaleScore, standardError, mastered, gap, not_yet, stopReason, and receiptId. Each span records profile, approved host, manifest operation id, HTTP status, upstream request id, native content/version IDs, fixture id/version, and response hash—never tokens, learner identifiers, responses, or scores. | ITD-027 |
mastery_engine_stateless_learner_boundary | mastery_engine | AlphaTest stores only immutable/versioned selection policies and scale calibrations; every learner fact is read from or written to Platform3 systems of record. | ITD-001 |
mastery_jwt_auth_and_tenant_routing | mastery_engine | verify signature, iss, aud, exp; require sub, role, tenantId, and endpoint scopes (mastery:run, mastery:read, mastery:simulate). Every upstream lookup is tenant-qualified. | ITD-008 |
mastery_platform3_workload_authentication | mastery_engine | Use two non-interchangeable server-side auth profiles. owner_conformance may mint short-lived tokens only from each owner-published POST {serviceBaseUrl}/dev/mint?tenantId=demo route, only for synthetic runMode=conformance, and never exposes or accepts those tokens at the AlphaTest boundary. production_learner requires a Platform3-published real-tenant workload exchange yielding tenant-, audience-, and operation-scoped JWTs; until published it is DEFERRED and no production learner route exists. Neither profile forwards the AcmeTest JWT, accepts caller upstream credentials, or uses a broad cross-tenant bearer. | ITD-026 |
mastery_poll_and_caliper_eventing | mastery_engine | clients call :inspect with the continuation token for current detail; AlphaTest emits acknowledged completion and synthetic recovery evidence to Caliper. | ITD-010 |
mastery_real_upstream_bindings | mastery_engine | Content, QTI, CASE, Results, Caliper, and NWEA-anchor capabilities use server-side base URLs, but only manifest operations backed by a reviewed live contract and passing wire probes may be status=bound; runtime traces resolved host/operation/request ID without payloads. | ITD-018 |
mastery_reviewed_upstream_binding_manifest | mastery_engine | upstream-bindings.json is the executable contract: each required capability maps to a published method/path, named workload-auth profile, tenant propagation, normalization, acknowledgement, source, and orchestration rule; route status and credential status are separate, and either gap keeps the capability unreleased with a concrete trigger. | ITD-024 |
mastery_scale_anchor_provenance | mastery_engine | a calibration applies a monotonic vertical transform to the posterior and includes standard error, anchor source/version/checksum/license scope, subject/grade coverage, validity, recovery tolerance, and limitations. | ITD-017 |
mastery_success_contract_release_gate | mastery_engine | Keep both start and score-recovery simulation absent while qti.resolve_adaptive_pool_members is a gap; a root-only 200 is evidence of the seam, not a usable pool. owner_conformance ships only after a demo QTI pool read resolves every member version and CASE/KC attribution and the full trace ends in 200/201. production_learner additionally requires real-tenant workload authentication and Results acknowledgement of one durable component per CASE GUID. Read-only policy/calibration endpoints may ship independently. | ITD-025 |
mastery_typed_problem_details | mastery_engine | application/problem+json following RFC 9457: type, title, status, detail, instance, code, requestId, retryable, and optional invalidParams/currentEtag/upstream. | ITD-009 |
mastery_zero_learner_retention | mastery_engine | policy/calibration tables contain no candidate, session, response, or result fields. Logs redact tokens, item response values, candidate identifiers, and request bodies; correlation IDs expire under the platform operational-log policy. | ITD-012 |
platform3_content_blueprint_pool_source | mastery_engine | Platform3 Content test_spec/test_bank remain the blueprint and bank identities; validate spec_id, bank_id, membership_rule=qti_adaptive_selection, and exactly zero Content bank_member rows. The adaptive pool source is the Bank-returned native QTI assessment-test artifactId/artifactVersionId. Read that immutable version with GET /qti/1edtech/implementation/api/tenants/{tenantId}/qti/artifact-versions/{artifactVersionId}/delivery-json; require HTTP 200, matching version/ETag, qti-assessment-test, and ordered item refs. Before selection, QTI must resolve each ref in that same immutable package graph to native member artifactId/artifactVersionId and canonical CASE standard/KC GUIDs. Hash SHA-256(rootArtifactVersionId, ETag, ordered(memberArtifactVersionId, qtiIdentifier, CASE GUIDs, KC GUIDs)), carry only the hash/native refs in the encrypted continuation, and reread before every offer. The root read is SHIP; member/KC resolution is DEFERRED until QTI publishes it. | ITD-023 |
reports_additive_v1_contract | reports | The path major version changes only for breaking semantics. Additive fields may appear within v1; enums include an explicit unknown fallback where upstream evolution can introduce values. Policy, calibration, crosswalk, and formula versions are data fields, not API versions. | ITD-015 |
reports_analytics_owned_cohort_rollups | reports | Cohort reads are deferred until Gate A publishes authenticated production class and school-grade per-standard mastery rollup contracts. The concrete reopening event is a versioned response for each grain that identifies class or school+grade, standards/KCs, numerator and denominator/population, formula or policy version, as-of time, suppression status and rule, source Results window, and provenance link. After reopening, class summaries proxy Analytics at GET /v1/classes/{classSourcedId}/cohort-report; grade summaries proxy it at GET /v1/schools/{schoolSourcedId}/grades/{grade}/cohort-report. Both require matching JWT resource constraints and OneRoster authorization. Reports never lists candidates and computes its own aggregate. | ITD-009 |
reports_axis_auth_shape | reports | Require signed bearer JWTs with sub, tenantId, iat, exp, role, and the OAuth-style permission scope reports:read or reports:write. Optional studentIds, schoolSourcedIds, and classSourcedIds are resource claim constraints that narrow access. Anonymous access is 401; a valid token lacking the required permission scope is 403; a requested resource outside claim constraints is the non-enumerating 404 defined by ITD-014. | ITD-021 |
reports_axis_concurrency | reports | Report resources expose source validators but have no client mutation, so Reports defines no If-Match write. The materializer honors Results/QTI conditional-write contracts internally; a source version race is retried from a fresh read, then surfaced as 409 with the stable source-version-conflict problem type and retryable=true if it cannot converge. | ITD-019 |
reports_axis_conformance_evidence | reports | Release requires: an unauthenticated 2xx fetch of the canonical and immutable docs URLs; the two production-signed, scoped principals and disjoint fixtures in ITD-031; contract tests for every documented status/envelope; anonymous and bidirectional cross-tenant probes; deterministic replay; the three-kind unified-runtime matrix in ITD-029; and an external AcmeTest-shaped consumer suite. For each claimed upstream capability, the run retains a redacted network/server trace naming upstream host, path family, request id, response status, and required response fields. The deployed regression first proves all seven report routes for all three test kinds against the immutable API target, then deploys architecture, coverage, and QC artifacts to their separate origins, reruns the same matrix, and proves both the API and public audit rerunner remain reachable. Smoke tests must fail if a worked example receives 503, lacks required fields, carries a coverage/audit build receipt, uses another test kind's vocabulary or prerequisites in either success or problem details, or cannot authorize the required reviewer principal; a fail-closed response is secure evidence, not success evidence. | ITD-025 |
reports_axis_error_envelope | reports | Failures use application/problem+json per RFC 9457 with stable absolute type, title, status, detail, instance, requestId, traceId, retryable, dependency, and optional fieldErrors. Stable types cover authentication, authorization, not found, validation, idempotency-conflict (409, same key/different request), source-version-conflict (409, authoritative versions did not converge), dependency unavailable, dependency incomplete, and internal error. Each symbolic name maps to one documented absolute type URI under the canonical docs origin. | ITD-023 |
reports_axis_eventing | reports | After Gate C opens list reads, ship polling with modifiedSince and cursor continuation. Until then, eventing is deferred with the read capability. Customer webhooks remain separately deferred until one registered audience has a production workflow whose result-visibility SLO is below the polling interval and supplies a stable HTTPS receiver; reopening requires signed delivery, replay, and dead-letter ITDs. | ITD-022 |
reports_axis_idempotency | reports | Idempotency-Key is required for materialization. For 24 hours Reports retains only an encrypted control record containing tenant id, method, canonical path, key hash, canonical request hash, operation id, lifecycle state, downstream idempotency keys, terminal status code, and timestamps—never a report body, score, response, or other learning fact. Same key and canonical request resumes or references that operation: completed operations skip all writes, recompose the report live from Platform3, return the recomposed status/body with the original operation id, and set Idempotent-Replayed: true. The replay is intentionally not byte-for-byte historical because upstream corrections must appear. Same key with a different canonical request returns the idempotency-conflict 409. Downstream keys derive deterministically from tenant, attempt, operation, and input hash. | ITD-020 |
reports_axis_list_endpoints | reports | The candidate-scoped report index is deferred until Gate C publishes an authoritative candidate/attempt index or exact attempt lookup that can serve it without a tenant scan. After reopening, ship that narrow index because AcmeTest must discover attempts without remembering ids. Cohort and form resources remain direct purpose-built reads behind Gate A. A global /attempt-reports tenant dump has its own reopening trigger: a registered compliance export job requires it and its minimization/redaction policy is pinned. | ITD-027 |
reports_axis_privacy_retention | reports | Reports persists no report or learning-fact body. The sole write-path control state is the encrypted, tenant-scoped, 24-hour metadata record enumerated in ITD-020; it contains no student outcome and is deleted at expiry. Structured logs exclude names, response bodies, scores, item responses, and tokens; they retain hashed principal, tenant, native resource ids where operationally required, dependency statuses, and trace ids for 30 days. Deletion and correction remain upstream-owned and are reflected on the next live recomposition. | ITD-026 |
reports_axis_query_model | reports | Query execution is deferred with populated list reads. After Gate C passes, list reads support documented exact-match filters, modifiedSince, one stable allowlisted sort with id tie-break, limit 1–100, and an opaque tenant-bound cursor. Unknown filters or sorts fail with 400. | ITD-018 |
reports_axis_read_shape | reports | Populated candidate list, attempt detail, and readiness reads are deferred until Gate C passes; equivalence and cohort reads are deferred until Gate A passes. The intended post-gate shape is list + detail + focused sub-resources. Evidence is a bounded projection of attempt detail, not an independently mutable resource. | ITD-017 |
reports_axis_tenant_routing | reports | Tenant comes only from verified JWT tenantId. Tenant ids do not appear in paths, query, or client-controlled routing headers. Every cache key, idempotency record, upstream request, log access field, and database query is tenant-scoped. | ITD-024 |
reports_axis_write_granularity | reports | Report data is read-only. Attempt materialization stays deferred until Gates B, C, and D pass, then ships as one idempotent per-attempt :materialize command. Improvement analysis stays deferred until Gate F passes, then ships as one idempotent per-administration :analyze command that writes only revision workflow state and receipts. Bulk commands remain deferred until a registered administration-close workflow proves at least 100 scored attempts per batch and per-resource calls breach the published completion SLO. | ITD-016 |
reports_blueprint_owned_gate_decision | reports | Reports evaluates no new gate rule. It presents the pass/fail outcome written to Results under the immutable Content test_spec criteria version, including achieved/required values and the complete gap list on failure. Missing criteria or coverage evidence makes status indeterminate, never pass. | ITD-006 |
reports_candidate_filter_invariant | reports | When the candidate report index reopens under ITD-027, every returned row must satisfy every supplied allowlisted filter after authorization, including testKind, status, testId, and modifiedSince. testKind is compared to the authoritative Results-to-Content value, never a fixture label or caller override. An empty match returns 200 with an empty page and terminal cursor; a row of another kind is a contract violation. Cursor state binds the normalized filter set and tenant/authorization fingerprint so a cursor cannot change kind, scope, or principal between pages. | ITD-035 |
reports_canonical_attempt_resource | reports | Populated AttemptReport reads are deferred until ITD-028 reopens them. The intended contract then requires every canonical report to identify candidate, administration, QTI attempt/test/session, Content blueprint, test kind, score, status, provenance, and upstream freshness. view selects bounded summary, standards, or evidence projections; omitted sections are named in omitted, never silently absent. | ITD-004 |
reports_conjunctive_release_policy | reports | No route, docs example, or product claim is marked released until every dependency gate for that capability and Gate D have passed in the same immutable release candidate. Attempt detail and readiness require C+D; candidate history requires C+D plus the authoritative index; materialization requires B+C+D; cohort and equivalence require A+D. The evidence bundle must contain successful non-503 responses with required fields and upstream traces. Closed gates may be represented in architecture and gap documentation, but a fail-closed stub is not deployed or advertised as an available route. Reopening occurs only when the named gate evidence exists; an implementation returning 503 does not reopen anything. | ITD-030 |
reports_diagnostic_score_with_gap_map | reports | Adaptive diagnostic reports require the mastery-engine scale score, scale/calibration version, standard error or interval, stopping reason, administered-item count, and the mastered/not-yet/gap map. Any MAP comparison is labeled a crosswalk, identifies the NWEA norms set, and is not presented as an NWEA-issued score. | ITD-007 |
reports_evidence_bearing_mastery_states | reports | Every standard and KC row is mastered, not_yet, gap, or insufficient_evidence and includes the policy/version, threshold, estimate, uncertainty, CASE GUID, and contributing QTI item/outcome references. A state without evidence is invalid. | ITD-005 |
reports_exact_attempt_composition_gate | reports | Every populated AttemptReport read and its candidate index remain deferred. The single concrete reopening event is a published and deployed, tenant-scoped Platform3 contract that accepts an exact QTI attempt id and returns exactly one settled Results record with versioned, dereferenceable identifiers for: candidate; administration; QTI attempt, session, test, and item outcomes; Content test_spec; AlphaTest test kind; gate criteria and decision; standard/KC mastery rows; and item/component evidence. An authenticated production probe must follow each identifier on the wire and prove tenant A cannot resolve tenant B’s attempt before the gate opens. | ITD-028 |
reports_explicit_upstream_freshness | reports | Every response includes sources[] with service, resource id, observedAt, version/etag, and status. Required source failure yields 503 and no apparently complete report. Optional enrichment failure yields 200 with incompleteSections and a problem object for each omitted section. Status 206 is reserved for a successful range response, as required by RFC 9110 §15.3.7. | ITD-012 |
reports_fail_closed_authorization | reports | Reports derives tenant and allowed students/classes/schools from the verified JWT, intersects those claim constraints with requested resources, and passes no broader access upstream. A missing resource and a resource outside those claim constraints both return the same 404 detail to prevent enumeration; logs retain the internal reason. | ITD-014 |
reports_form_equivalence_evidence | reports | Equivalence reads are deferred until Gate A publishes an authenticated production Analytics form-equivalence contract. The concrete reopening event is a versioned response identifying blueprint and form ids, coverage/DOK match, sample sizes and population definition, method, statistic, confidence interval, tolerance, decision, analysis version, suppression status/rule, and downloadable evidence artifact. insufficient_evidence is first-class. | ITD-010 |
reports_formative_shared_schema | reports | testKind=formative uses the canonical attempt schema, returns immediate per-standard evidence, and writes through Results. It does not emit grade-level certification or external-test readiness unless the underlying blueprint explicitly carries qualifying coverage evidence. | ITD-008 |
reports_improvement_analytics_contract | reports | Post-administration item and form analytics are a DEFERRED capability behind Gate F. Reopening requires authenticated, tenant-scoped Analytics/Caliper contracts that return versioned item difficulty, item discrimination, misconception-tagged distractor-response distributions, form difficulty/equivalence summaries, population and sample counts, suppression status and rule, analysis window, formula version, and immutable artifact references for one scored administration. Reports composes those owner-produced metrics and never derives cohort aggregates from candidate rows. If any required rollup is absent, AlphaTest files a Platform3 issue naming the missing field or grain, marks only the affected metric unavailable, and continues independent metrics whose owner receipts are complete; it never substitutes private math. | ITD-036 |
reports_improvement_evidence_receipts | reports | The evidence surface serves tenant-authorized, content-addressed alignment reports and item-improvement ledgers for every completed improvement run. GET /v1/improvement-runs/{improvementRunId}, /alignment-reports/{sourceKey}, and /revision-orders expose JSON metadata plus short-lived download links to immutable receipt bundles containing the Analytics/Caliper artifact references, per-source alignment contributions, policy and formula versions, threshold decisions, order lifecycle, Bank/Blueprint delivery receipts, omissions, and SHA-256 digest; they contain no credentials or copied learner facts. A run is complete only when each scored administration has item/form metric statuses, one alignment record for every named source test, every tripped order has a target acknowledgement or explicit blocked-upstream status, and the evidence links dereference. Release proof must exercise this acceptance chain on the production origin with anonymous rejection, same-tenant success, cross-tenant non-enumeration, and upstream traces. | ITD-040 |
reports_materialization_write_through | reports | Materialization is not released. It reopens only when Gates B, C, and D are satisfied together by authenticated wire evidence: Results and Caliper support the retry-safe protocol in ITD-032, and Results exposes the settled record through the exact attempt-keyed composition contract in ITD-028. After reopening, a scored attempt is reportable only after AlphaTest idempotently writes its settled outcome and components to Results, emits the corresponding Caliper event, and reads the exact Results record back. Partial completion returns a typed dependency problem with a retry-safe operation id. | ITD-002 |
reports_native_platform3_ids | reports | Paths and representations use QTI attempt/session/test ids, Results result_record ids, Content test_spec ids, CASE GUIDs, and OneRoster sourcedIds. AlphaTest adds only a report operation id for retry tracing; it never introduces aliases for upstream entities. | ITD-003 |
reports_no_production_token_mint | reports | The canonical production Reports origin never exposes POST /api/dev/mint, /dev/mint, or an equivalent caller-accessible signing route; those paths return the same non-enumerating 404 as any absent route. Reviewer credentials are minted out of band by the deployment pipeline from the production signing secret, are short-lived and scope/tenant/resource constrained, and the signing secret never enters client code or a request-addressable function. A release receipt proves the mint paths are absent, anonymous tenant-data reads return 401, same-tenant reads return 200, and bidirectional cross-tenant reads return the same 404. | ITD-034 |
reports_per_source_alignment_metric | reports | For each named source assessment and immutable crosswalk version, Reports publishes alignment_percent = 100 × Σ(weight_s × coverage_s × rigor_s) / Σ(weight_s) across every source requirement s. weight_s is the source blueprint's declared point or item weight; coverage_s is 1 only when the requirement maps to a blueprint slot and 0 otherwise; rigor_s is 1 when target DOK is equal or higher and 0 otherwise. Missing, ambiguous, stale, or lower-DOK mappings therefore contribute zero and remain enumerated in the receipt; an empty denominator is invalid, never 100. The record pins formula_version, source assessment/version, Content test_spec/version, crosswalk hash, numerator, denominator, per-requirement contributions, and limitations. Predicted-versus-actual readiness is a separate Analytics-owned, population/suppression/versioned comparison included only when an authenticated external-score artifact exists; absence is explicit and does not alter structural alignment. | ITD-037 |
reports_results_caliper_materialization_protocol | reports | Gate B opens only when Platform3 publishes and production-proves: the versioned Results result_record plus test_result_components request/response schema; conditional and idempotent write behavior; the Caliper endpoint and event profile referencing the same native attempt/result ids; and an exact settled Results read-back. One AlphaTest operation derives distinct deterministic downstream idempotency keys, writes Results/components, emits Caliper, and records only the bounded control metadata in ITD-020. A retry after Results success but Caliper failure must observe the existing Results write, emit Caliper exactly once, then read back the settled record. Success is returned only after both upstream receipts and read-back agree. The wire proof includes a forced partial-failure replay and confirms no duplicate Results record, component, or Caliper event. | ITD-032 |
reports_revision_engine_state_boundary | reports | AlphaTest Supabase stores only tenant-scoped improvement workflow state: improvement_run_id, deterministic revision_order_id, target module, native upstream ids and immutable evidence references, reason codes, policy/formula versions, threshold comparison, lifecycle status, idempotency hash, delivery attempts, target receipt, supersession links, and timestamps. It stores no student identity, response, score, mastery fact, distractor count, cohort aggregate, or copied Analytics artifact. Reads and writes are API-fronted, require verified service or reports JWT claims, are tenant-scoped in every query, and return the same non-enumerating 404 across absent and cross-tenant ids. Results, Caliper, Analytics, QTI, Content, CASE, Bank, and Blueprint remain authoritative; evidence is dereferenced live and stale or unreadable references fail closed. | ITD-039 |
reports_stateless_composition_boundary | reports | AlphaTest stores no attempts, responses, result records, mastery state, candidates, or aggregates. Each response composes live Platform3 data with versioned AlphaTest blueprint/scale working state and may cache only HTTP bytes privately for at most 30 seconds, keyed by tenant and authorization fingerprint. | ITD-001 |
reports_thresholded_revision_orders | reports | After Gate F opens, POST /v1/administrations/{administrationId}/improvement-runs:analyze requires Idempotency-Key and emits deterministic revision orders only from versioned threshold policies and owner artifact references. Weak-item orders target Bank regeneration when a released policy trips on sufficient-sample discrimination, difficulty, dead or untagged distractors, or miskey evidence; calibration-delta orders target Blueprint when per-source predicted-versus-actual readiness breaches its released tolerance or the structural alignment receipt contains a correctable blueprint defect. Every order carries native tenant, administration, QTI item/form/test, Content test_spec/version, CASE/source-test ids, reason codes, observed metric and threshold, analysis policy/version, upstream evidence refs, requested action, target module, and deterministic order id. Gate F remains closed for a target until Bank or Blueprint publishes an authenticated, idempotent same-tenant service command and a wire receipt proves accepted, replayed, and rejected-cross-tenant behavior; Reports never edits a bank or blueprint directly. | ITD-038 |
reports_traceable_upstream_calls | reports | Server-only base URLs select QTI, Results, Analytics, Content, CASE, OneRoster, Caliper, and mastery/blueprint services. Each upstream call propagates a request/trace id and authenticates with a least-privilege service credential or delegated token; no browser calls Platform3 directly. Implementation evidence must name the exact URL and captured call for each capability. | ITD-013 |
reports_two_tenant_release_proof | reports | Gate D cannot pass with the public demo mint or one tenant. The deployment pipeline provisions two short-lived production-signed reviewer JWTs, tenant A and tenant B, with the exact reports:read/reports:write scopes and disjoint candidate/class/school constraints, plus one authoritative fixture attempt per tenant. Automated probes prove anonymous requests return 401, same-tenant reads succeed, A requesting B and B requesting A both return the same non-enumerating 404, and no response, trace, cache entry, or idempotency replay exposes the other tenant. Tokens and student facts are redacted from retained evidence. If either credential or fixture is unavailable, certification is inconclusive and release remains closed. | ITD-031 |
reports_unified_canonical_runtime | reports | Exactly one immutable unified Reports runtime owns the canonical API origin and all /v1 routes. Architecture, coverage, and QC sites deploy to a separate stable documentation origin or immutable artifact targets and may never claim, rewrite, or alias the API origin. The runtime derives testKind only from the exact authoritative attempt → Results → Content composition; callers cannot select or override kind. The unified handler dispatches kind-specific projections internally while preserving one schema, and every dependency problem derives its vocabulary, requirements, and remediation from that authoritative kind. Every response emits one runtime release receipt, never a coverage or audit receipt. Deployment promotion is atomic, and a post-promotion matrix sends mastery-gate, adaptive-diagnostic, and formative fixture attempts through the same origin before and after every docs/coverage/QC deployment; each must return only its own vocabulary and provenance while the public audit rerunner remains reachable. | ITD-029 |
reports_upstream_receipt_build_gate | reports | Before the driver invokes any Reports implementation@test_kind doer, it must validate a machine-readable prerequisite manifest containing immutable authenticated receipts for that kind: mastery_gate and formative require Gates B, C, and D; adaptive_diagnostic also requires a production-learner Mastery Engine receipt; cohort/equivalence work additionally requires Gate A; improvement-loop work requires Gate F. A missing or failed receipt causes an atomic pre-execution transition to escalated/parked, appends a non-blocking owner escalation, and launches neither the implementation doer nor its customer/rubric evals. Production-success evals are instantiated only after the prerequisite check passes. Specification cells may continue, and a new owner receipt reactivates the parked cell on the next watchdog or bridge pass. No stub, sandbox route, permanent 503, or closed-gate evaluation can stand in for the customer job. | ITD-041 |
reports_versioned_readiness_claims | reports | Readiness reads are deferred with AttemptReport until Gate C provides the exact gate decision and Content blueprint linkage. After reopening, each named-test entry gives projected_pass|not_ready|indeterminate, source test/version, crosswalk version, coverage fraction, DOK dominance result, qualifying blueprint slots, decision rule/version, and limitations. Only complete equal-or-higher-DOK coverage plus satisfied gate criteria may produce projected_pass. | ITD-011 |
three_state_mastery_classification | mastery_engine | policy pins KC cut score and confidence threshold. Above-cut confidence yields mastered; below-cut confidence yields gap; everything else is not_yet, always with posterior probability and evidence item refs. | ITD-014 |
versioned_bayesian_kc_estimator | mastery_engine | calibration pins posterior model family, priors, item/KC parameters, scoring transform, numeric precision, and runtime version; only QTI-scored outcomes update it. | ITD-013 |