EDU-011 — Bounded content import assets, jobs, and export policy

Status: bounded capability delivered
Type: implementation program
Phase: 3 / 6
Delivered migration: V4130 only

Delivered tenant-admin outcome

Education owns tenant-scoped import asset metadata and durable import jobs while reusing only public Infra APIs for private-file operations and other platform primitives. The delivered job lifecycle has exactly five states: PREVIEW, PENDING, PROCESSING, COMPLETED, and FAILED.

The bounded capability provides:

durable atomic claim with lease token, heartbeat, expired-lease recovery, bounded attempts, and terminal failure;
tenant-scoped duplicate safety for preview requests and execution, so at-least-once delivery does not create a second logical job or repeat completed effects;
fail-closed scanning: the default scanner result is UNAVAILABLE, and unavailable, infected, or errored scans are never executable;
CSV/XLSX preview metadata when no parser is available; this reports file/type metadata only and does not claim row parsing or content validation;
execution only after the scan is clean and the preview explicitly reports executable parsed content;
an export-request redaction policy that excludes answers and private fields from authorized export requests.

Ownership and reuse boundary

Education owns education_content_import_asset, education_content_import_job, their business state, duplicate keys, lease/recovery semantics, preview policy, and execution orchestration.
Infra continues to own generic file storage and platform facilities. Education integrates through public Infra APIs only; it does not depend on Infra DOs, mappers, ServiceImpl classes, or private implementation packages.
V4130 is the only EDU-011 schema migration in this slice. No additional migration, generic scanner platform, generic scheduler, or Infra-internal extension is delivered.

Deferred scope

No generated export file, downloadable export artifact, export worker, or export-job persistence is delivered. Only the request-time redaction policy is established.
No production malware-scanner integration is delivered; the default remains fail-closed UNAVAILABLE until an external scanner adapter is configured.
No full CSV/XLSX parser is promised by the fallback. Without an available parser, preview remains metadata-only and execution is blocked.
File retention/deletion automation, dead-letter tooling, operator UI, partial-row import reporting, and legacy asset migration/re-scan remain deferred.

Acceptance record

Education-owned import assets and durable jobs are represented by V4130.
Jobs use the five-state lifecycle PREVIEW, PENDING, PROCESSING, COMPLETED, FAILED.
Claim, lease, heartbeat, expired-lease recovery, retry bounds, and duplicate safety are defined.
Scanning fails closed, with default UNAVAILABLE.
CSV/XLSX can return metadata-only preview when the parser is unavailable.
Execute is blocked unless scanning is clean and preview content is executable.
Export requests apply answer/private-field redaction policy.
Generated export files and the remaining operational features are deferred as listed above.

Risk and rollback

Risk: Import processing remains security-sensitive; scanner or parser absence intentionally removes executability rather than degrading silently.
Rollback: Disable import handlers while preserving Education asset/job state for inspection and forward recovery. Do not bypass scan or executable-preview gates.

3.5 KiB Raw Blame History