One request to an assignable, verified Platform3 bank

One owner for every fact

Chosen. AlphaTest owns generation workflow state, deterministic Incept-JSON→QTI conversion code, slot-verification policy, and audit composition only. Incept owns generated source items; CASE owns standards; Content/QTI own specs, forms, banks, packages, keys, and scoring.

Rationale. One orchestrator removes manual glue without creating a shadow source of truth.

Status: active · Outcome: SHIP · Date: 2026-07-16 · Author: alphatest-loop · supersedes: none · superseded_by: none

One observable asynchronous operation

Chosen. After the requested capability's dependency preflight passes, generation or legacy alias-proof import returns 202 with one stable operation URI and runtime terminal states ready, ready_with_gaps, failed, or cancelled. For generated fixed/adaptive banks, only ready with that capability's complete owner receipt may be assignable; for legacy alias proof, ready means all 17 owner aliases were proven with bankId:null, ownerMutationCount:0, and assignable:false. The immutable release-conformance suite is stricter than ordinary runtime observation: fixed, adaptive, and all-17-legacy replay are three required assertions, and each MUST terminate ready with zero gaps before the suite can record certification—merely reaching failed or another terminal is a failed assertion, never a pass.

Rationale. Separating runtime state from the conformance pass predicate preserves observable failures without allowing a test harness to certify them.

Owning sources. source contract

Status: active · Outcome: SHIP · Date: 2026-07-17 · Author: alphatest-triage+2026-07-17-005 · supersedes: none · superseded_by: none

Real upstream calls are a readiness invariant

Chosen. Production operations and immutable conformance call the configured Incept, Content, QTI, and CASE origins at runtime and retain sanitized host, method, operation, status, native identity or hash, request/trace ID, and timestamp. Conformance binds the verified reviewer-bank caller tenant to the exact server-configured QTI platform tenant UUID; demo fixtures, copied owner data, and local mocks can never produce ready or a certification receipt.

Rationale. Behavior without tenant-exact upstream wire evidence is not integration.

Status: active · Outcome: SHIP · Date: 2026-07-17 · Author: alphatest-triage+2026-07-17-005 · supersedes: none · superseded_by: none

Platform-native identifiers cross the boundary

Chosen. Generation requests accept Content specId; generated-bank success returns Content bankId/formId, QTI packageId/artifactId/artifactVersionId, and CASE identifiers verbatim. Legacy alias-proof success instead returns exactly 17 ordered owner aliases with bankId:null, ownerMutationCount:0, and assignable:false. AlphaTest adds only operationId and proof metadata; known legacy UUIDs remain untrusted until tenant-aligned owner reads reconcile them.

Rationale. AcmeTest can assign and deliver without translation glue, while owner authority—not local possession of an identifier—establishes identity.

Status: active · Outcome: SHIP · Date: 2026-07-16 · Author: alphatest-loop · supersedes: none · superseded_by: none

Every blueprint slot must pass independently

Chosen. Admit an item only when primary CASE identity, DOK, requested interaction, QTI validation, Platform3 correct-response score, and provenance all pass. Quarantine failures by upstream reference; partial forms never join a bank.

Rationale. One invalid item breaks the gate claim.

Owning sources. source contract

Status: active · Outcome: SHIP · Date: 2026-07-16 · Author: alphatest-loop · supersedes: none · superseded_by: none

Deterministic Incept JSON to QTI 3.0 conversion

Chosen. The converter maps Incept artifact semantics to canonical QTI 3.0 XML, response declarations/processing, accessibility metadata, media resources, and CASE tags. Equal normalized input plus converter version yields the same package hash; conversion may reject but never rewrite content.

Rationale. Replayable conversion with no second author.

Status: active · Outcome: SHIP · Date: 2026-07-16 · Author: alphatest-loop · supersedes: none · superseded_by: none

Platform3 QTI is the scoring oracle

Chosen. For every converted item, submit the Incept expected response through a pseudonymous QTI delivery session and attempt; require the documented correct score and applied processing trace, then bind source hash, QTI version ID, input hash, outcome, and trace ID.

Rationale. Proves the production scorer, not AlphaTest's interpretation.

Owning sources. source contract

Status: active · Outcome: SHIP · Date: 2026-07-16 · Author: alphatest-loop · supersedes: none · superseded_by: none

Unsupported capability becomes an upstream issue

Chosen. If Incept cannot generate, the converter cannot represent, or QTI cannot score a requested type, record the exact slot and boundary, open/link an upstream Issue with a reproducer and proof metric, and return only a non-assignable audit result when blueprint policy permits.

Rationale. Protects rigor and creates a falsifiable reopen event.

Status: active · Outcome: SHIP · Date: 2026-07-16 · Author: alphatest-loop · supersedes: none · superseded_by: none

Fixed-form and adaptive membership stay distinct

Chosen. same_blueprint_fixed_forms creates ordered bank_member references with positive form_index; qti_adaptive_selection creates the Content bank but keeps selection/pool structure inside QTI and creates no fabricated fixed member list.

Rationale. Preserves distinct fixed/adaptive semantics and Content ownership.

Status: active · Outcome: SHIP · Date: 2026-07-16 · Author: alphatest-loop · supersedes: none · superseded_by: none

Prove all 17 legacy aliases without owner mutation

Chosen. Immutable conformance MUST load the owner-published timeback-alphatest-legacy-forms-v1 collection for the configured reviewer-bank/QTI tenant binding, validate its canonical sha256:<64 lowercase hex> manifest identity without rewriting it, read all 17 ordered artifactVersionIds from QTI, reconcile each owning artifactId and Content alias, and verify CASE/scoring/provenance. It returns aliases[17] in governed order with bankId:null, ownerMutationCount:0, and assignable:false: legacy import is an alias-proof operation and MUST NOT create a Content test_bank, bank_member rows, QTI artifacts, or any other owner mutation. The conformance assertion passes only when that exact immutable-deployment operation terminates ready with zero gaps and sanitized QTI/Content receipts. Public legacy admission remains fail-closed until its mode-specific positive receipt is explicitly published. Never regenerate, register, mutate, reduce the set, substitute local IDs, or treat a known ID list alone as authority.

Rationale. An alias proof makes all 17 existing owner records import-visible with provenance while preserving the accepted zero-mutation boundary and preventing AlphaTest from inventing a second legacy bank.

Owning sources. source contract · source contract

Status: active · Outcome: SHIP · Date: 2026-07-24 · Author: alphatest-triage+2026-07-24-007 · supersedes: BANK-ITD-010 · superseded_by: none

Bind generation to Incept manifest schema v1

Chosen. Fetch GET https://incept-skill-pack.vercel.app/api/skill-pack before a run and require schemaVersion===1, generation endpoint equality, bearer auth, available question skill, and declared request/response schemas. POST one slot with skillId:"question", canonical subject/grade, parameters.mode:"brainlift", CASE URI/identifier in parameters.target, the exact manifest-enumerated parameters.dok and parameters.interactionType, and intent.purpose:"assessment". Accept only HTTP 2xx with ok:true, outcome:"artifact", nonempty generationRunId, and artifact; preserve run ID and response hash. A requested interaction outside the live enum or a blocked outcome is a slot gap, never locally reconstructed.

Rationale. The owner-published versioned envelope is executable; one-slot calls give AlphaTest stable correlation without inventing Incept fields.

Owning sources. source contract

Status: active · Outcome: SHIP · Date: 2026-07-16 · Author: alphatest-loop · supersedes: BANK-ITD-019 · superseded_by: none

Ingest QTI once through Content write-through

Chosen. Submit deterministic QTI 3.0 ZIP once to Content’s QTI-package import with server auth and child idempotency key; require 202, trusted import, and created native IDs, then read each QTI delivery JSON by returned version ID and verify identity plus canonical hash. Never double-ingest through QTI.

Rationale. One mutation owner plus D5 read-back.

Owning sources. source contract · source contract

Status: active · Outcome: SHIP · Date: 2026-07-16 · Author: alphatest-loop · supersedes: none · superseded_by: none

Register and read back Content-owned banks

Chosen. For generated fixed/adaptive capabilities, create content_kind:"test_bank" through Content’s authenticated, idempotent item-create endpoint only after owner identities are reconciled. Fixed mode writes ordered bank_member references with exact Content/QTI aliases; adaptive mode writes no fabricated fixed member rows because selection remains QTI-owned. Require item detail and the mode-appropriate authoritative read-back before assignable ready. Legacy alias proof is excluded from this mutation contract: it returns bankId:null, ownerMutationCount:0, assignable:false and creates no Content test_bank or bank_member rows.

Rationale. Content remains authoritative for generated banks, while the explicit legacy exclusion prevents an alias-proof read from being laundered into an unauthorized owner mutation.

Owning sources. source contract · source contract · source contract

Status: active · Outcome: SHIP · Date: 2026-07-16 · Author: alphatest-loop · supersedes: BANK-ITD-022 · superseded_by: none

Checkpoint only orchestration state

Chosen. All operations begin admitted only after capability preflight. Generation advances through spec_resolved → standards_resolved → generated → converted → qti_ingested → scoring_proved → content_registered → membership_read_back → terminal. Legacy alias proof advances through owner_collection_read → all_versions_read → aliases_reconciled → scoring_proved → zero_mutation_asserted → terminal; content_registered and membership_read_back are invalid legacy phases. Restart generation by re-reading upstream identity/hash before replaying an idempotent child write; restart legacy only with owner reads and an assertion that ownerMutationCount remains zero.

Rationale. Artifact-class-specific checkpoints make recovery safe and make the legacy zero-mutation invariant mechanically visible instead of silently passing through registration phases.

Status: active · Outcome: SHIP · Date: 2026-07-16 · Author: alphatest-loop · supersedes: none · superseded_by: none

API-fronted, tenant-claim-scoped storage

Chosen. Supabase/Postgres is server-only; service credentials never reach clients. Every operation, idempotency, checkpoint, and evidence query includes the verified JWT tenant claim; cross-tenant identifiers return indistinguishable 404.

Rationale. No anonymous or cross-tenant data path.

Status: active · Outcome: SHIP · Date: 2026-07-16 · Author: alphatest-loop · supersedes: none · superseded_by: none

Independent capability receipts open release

Chosen. Certification and public admission are capability-specific, never global. Owner release certification SAME_BLUEPRINT_FIXED_FORMS-2026-07-21 is published with release_state=ready on the previously wire-verified basis: authenticated Incept artifacts since 2026-07-16, Content test_spec create/read/idempotent-replay conflict (platform3#787), QTI ingest/scoring, governed source catalog ITD-033 release_state=ready, conforming per-tenant three-slot credentials 7/7, and positive operation bop_5WX5F484ZYGMHC9K58VSEMD5PP. Public same_blueprint_fixed_forms creates are therefore admitted and return 202 after preflight. This certification cannot open qti_adaptive_selection or legacy import: each remains typed-424 fail-closed until its own current immutable-deployment ready/zero-gap receipt is explicitly published. The immutable conformance envelope itself MUST bind caller tenant reviewer-bank (33979ed1-36ac-4973-8b2e-181f311c0d5f) to the exact configured QTI_PLATFORM_TENANT_ID, use distinct server-held Content/QTI/CASE credentials with no PLATFORM3_JWT fallback, replay fixed, adaptive, and timeback-alphatest-legacy-forms-v1 all-17 operations on that same immutable hostname, require ready as the only passing terminal for all three, retain sanitized owner traces, and prove an owning-tenant 200 versus same-shape cross-tenant 404. Stable production-alias admission changes only after the relevant mode-specific certification receipt is recorded.

Rationale. An explicit owner release artifact breaks the fixed-form adoption deadlock while tenant-exact, per-mode receipts keep unproved capabilities and cross-tenant paths fail-closed under DoD D2 and D5.

Owning sources. source contract

Status: active · Outcome: SHIP · Date: 2026-07-21 · Author: alphatest-triage+2026-07-21-002 · supersedes: BANK-ITD-025 · superseded_by: none

One operation per public write

Chosen. POST creates one generation or legacy-import operation after preflight; no public item-authoring or multi-bank atomic endpoint.

Rationale. Clearest retry and ownership boundary.

Status: active · Outcome: SHIP · Date: 2026-07-16 · Author: alphatest-loop · supersedes: none · superseded_by: none

List, detail, and immutable manifest

Chosen. Expose operation list/detail and manifest subresource; bank/form bodies remain direct Platform3 reads through returned IDs.

Rationale. Diagnose workflows without duplicating Content/QTI.

Status: active · Outcome: SHIP · Date: 2026-07-16 · Author: alphatest-loop · supersedes: none · superseded_by: none

Bounded filters and opaque cursor paging

Chosen. Filter operations by status, kind, specId, bankId, and RFC3339 modifiedSince; sort createdAt/updatedAt; page by opaque cursor with bounded limit.

Rationale. Reconciliation without leaking storage grammar.

Status: active · Outcome: SHIP · Date: 2026-07-16 · Author: alphatest-loop · supersedes: none · superseded_by: none

Immutable requests and native upstream ETags

Chosen. No public PATCH/PUT; snapshots return ETags for cache validation. Each upstream mutation requiring If-Match uses the ETag read from that same tenant resource.

Rationale. Reproducible execution plus native optimistic concurrency.

Status: active · Outcome: SHIP · Date: 2026-07-16 · Author: alphatest-loop · supersedes: none · superseded_by: none

Tenant-scoped idempotency on every POST

Chosen. Every public POST requires Idempotency-Key. Same tenant/key and canonical request returns the same operation; changed method/path/body returns typed 409. Deterministic child keys isolate upstream writes.

Rationale. Lost-response safety without duplicate mutation.

Status: active · Outcome: SHIP · Date: 2026-07-16 · Author: alphatest-loop · supersedes: none · superseded_by: none

Verified JWT plus explicit bank scopes

Chosen. Require a signed unexpired caller Bearer JWT with sub,role,tenantId,iat,exp; reads require bank:read and writes bank:write. Upstream calls use distinct server-held least-privilege CONTENT_SERVICE_TOKEN, QTI_SERVICE_TOKEN, and CASE_SERVICE_TOKEN credentials (plus the separate Incept credential where generation runs). No slot may fall back to PLATFORM3_JWT, another service's token, the caller token, or a demo mint; missing, mismatched, expired, or under-scoped credentials fail closed before certification.

Rationale. Per-service credentials make least privilege observable and remove the shared-token cross-service blast radius.

Status: active · Outcome: SHIP · Date: 2026-07-17 · Author: alphatest-triage+2026-07-17-005 · supersedes: none · superseded_by: none

Polling ships; webhooks have a concrete trigger

Chosen. v1 ships polling, Retry-After, ETag, and modifiedSince. Webhooks reopen when a registered external consumer proves polling misses a documented assignment-latency SLO and supplies a signed-callback receiver.

Rationale. Current job is met with one reliable primitive; trigger is concrete and falsifiable.

Status: active · Outcome: DEFERRED · Date: 2026-07-16 · Author: alphatest-loop · supersedes: none · superseded_by: none

Typed RFC 7807 errors

Chosen. Every non-2xx is application/problem+json with stable type/title/status/detail/code/requestId/traceId and optional safe field/upstream arrays; never expose tokens, item bodies, or answer keys.

Rationale. One branchable client contract and no leakage.

Status: active · Outcome: SHIP · Date: 2026-07-16 · Author: alphatest-loop · supersedes: none · superseded_by: none

Verified JWT claim controls tenant routing

Chosen. Public paths have no tenant parameter. Derive the AlphaTest tenant only from the verified JWT; compatibility X-Timeback-Tenant must equal the claim or returns 403, and scope every local/upstream operation to it. Immutable conformance additionally requires server configuration that maps reviewer-bank to its exact QTI platform tenant UUID and signs that UUID into the deployment-host-bound envelope; the request cannot choose or override the mapping. Reads for a valid identifier owned by another tenant return the same RFC 7807 resource_not_found 404 shape as an unknown identifier.

Rationale. Caller-controlled routing cannot cross tenants or enumerate another tenant's resources.

Status: active · Outcome: SHIP · Date: 2026-07-17 · Author: alphatest-triage+2026-07-17-005 · supersedes: none · superseded_by: none

Contract and integration proof travel together

Chosen. One immutable-host conformance run covers fixed, adaptive, and the governed all-17 legacy alias-proof operation under the configured reviewer-bank/QTI tenant binding, while producing three independent mode receipts. Every assertion requires status=ready and zero gaps; failed, cancelled, ready_with_gaps, timeout, or missing evidence fails the suite. Receipts retain sanitized Content/QTI/CASE/Incept host, method, status, native IDs/hashes, request/trace IDs, and timestamps; prove distinct credential slots, public-alias fail-closed behavior for uncertified modes, anonymous rejection, same-shape 404 cross-tenant isolation, idempotency conflict, QTI scoring, generated-bank Content registration/read-back, adaptive QTI-order plus Content-KC reconciliation, and exact all-17 alias replay with bankId:null, ownerMutationCount:0, assignable:false. A green fixed receipt cannot certify adaptive or legacy, and a later failed sibling replay cannot revoke the already published fixed certification.

Rationale. Strict per-mode assertions inside one tenant-exact envelope produce auditable adoption evidence without coupling public release decisions.

Status: active · Outcome: SHIP · Date: 2026-07-17 · Author: alphatest-triage+2026-07-17-005 · supersedes: none · superseded_by: none

Keep audit metadata, never learning content

Chosen. Persist tenant-scoped operation metadata, upstream IDs, hashes, states, and audit evidence—never item bodies, keys, learner data, attempts, or mastery. Privileged deletion never cascades to Platform3.

Rationale. Auditability within AlphaTest's ownership boundary.

Status: active · Outcome: SHIP · Date: 2026-07-16 · Author: alphatest-loop · supersedes: none · superseded_by: none

One operation collection; no shadow catalog

Chosen. /bank-operations lists generation and legacy-import operations with a kind discriminator. Bank/item discovery stays in Content/QTI.

Rationale. One list primitive without duplicating upstream discovery.

Status: active · Outcome: SHIP · Date: 2026-07-16 · Author: alphatest-loop · supersedes: none · superseded_by: none

Project the verified adaptive pool into immutable evidence

Chosen. QTI owns the adaptive pool root and authoritative ordered member identities; Content owns each imported item's KC relationships. For each ordered QTI member, Bank reconciles its native immutable QTI identity to the Content contentId, then reads GET .../items/{contentId}/kc-tags and requires exactly one primary relationship whose knowledgeComponentGuid equals the generated blueprint slot (with owner-published weight/confidence retained). Bank MUST NOT require caseStandardGuids or knowledgeComponentGuids on QTI item refs, infer KC from titles, or add KC metadata to QTI. Missing, duplicate-primary, mismatched, or unreconciled Content KC proof fails closed. Exact immutable operation bop_3BZPK6BKJ91MS9RP4VXRAYR7KG is the regression shape: conformance must preserve root 66338a93-fe08-4f1a-80f5-39c51032b2dc and its six-member QTI order, obtain KC proof from Content, and reach ready, assignable:true, non-null stable adaptivePool, zero gaps, and sanitized QTI/Content/KC-owner receipts. Public qti_adaptive_selection admission and the stable alias remain unchanged until that positive mode receipt is explicitly published; repeat reads must preserve the canonical manifest hash and strong ETag.

Rationale. The reconciliation joins two real owners without moving either boundary: QTI proves selection order, and Content proves the diagnostic KC relationship.

Owning sources. source contract · source contract · source contract

Status: active · Outcome: SHIP · Date: 2026-07-20 · Author: alphatest-triage+2026-07-20-006 · supersedes: none · superseded_by: none

Reject diagnostically empty distractors

Chosen. For every selected-response item, slot verification requires every incorrect response choice to carry a non-empty Incept-authored named misconception tag, requires each tag to be distinct from the correct response and traceable to the generated source artifact, and preserves the choice-to-misconception mapping through deterministic QTI conversion and Content/QTI read-back evidence. An untagged, dead, duplicated, or answer-key-conflicting distractor fails the slot and quarantines the item; Bank never invents or repairs misconception labels locally. Non-selected-response interactions record distractor verification as not_applicable with their interaction type rather than fabricating distractors.

Rationale. The module promises diagnostic information from every wrong selected response; making the mapping a per-slot admission predicate prevents structurally valid but diagnostically empty items from entering a bank.

Status: active · Outcome: SHIP · Date: 2026-07-24 · Author: alphatest-loop · supersedes: none · superseded_by: none

Regenerate and rotate weak items without rewriting history

Chosen. A reports-owned revision order naming a weak item and reason (non-discriminating, dead or untagged distractor, or miskeyed) starts a new idempotent Bank regeneration operation that requests a replacement from Incept for the same blueprint slot, runs the complete slot, misconception, QTI-conversion, scoring, and owner-read verification chain, and only then rotates the new immutable QTI artifactVersionId into Content-owned bank membership with provenance linking revisionOrderId, replacedArtifactVersionId, replacementArtifactVersionId, Incept generationRunId, and effectiveAt. The prior artifact remains owner-retained for audit and in-flight administrations; failed replacement verification leaves membership unchanged. Bank never edits the old item, authors a replacement locally, or recomputes Reports analytics.

Rationale. An append-only verified rotation closes the Reports-to-Bank improvement loop without violating upstream ownership, auditability, or active-test stability.

Owning sources. source contract

Status: active · Outcome: SHIP · Date: 2026-07-24 · Author: alphatest-loop · supersedes: none · superseded_by: none