56 lines
6.7 KiB
Markdown
56 lines
6.7 KiB
Markdown
# EDU-014 — Extended student and secondary learning waves
|
|
|
|
- **Status:** partial implementation; bounded representative wave delivered
|
|
- **Type:** family disposition plus executable vertical slices
|
|
- **Phase:** 5
|
|
- **Migration:** `V4160__add_bounded_learning_wave.sql`
|
|
|
|
## Delivered bounded wave
|
|
|
|
| Family | Target owner / reused public capability | Data and API disposition | Priority | Verification disposition |
|
|
|---|---|---|---|---|
|
|
| Auth compatibility and phone/OAuth binding | Member + System auth APIs | **Replaced/reused.** Education does not copy credentials, sessions, phone binding, or OAuth state. Existing Member login remains the student entry point. Legacy auth data requires a separate identity migration, outside V4160. | Reuse now | Existing auth tests; no EDU-014 schema |
|
|
| Profile and education profile extensions | Member owns generic profile; Education owns learning projections | **Partially migrated.** Learning summary is Education-owned and exposes aggregate counts only. New generic profile fields are deferred. | P1 bounded | Summary service/API tests and tenant isolation |
|
|
| Vocabulary learning/review | Education | **Migrated for new writes.** Tenant/student/key progress and deterministic review scheduling are delivered. Legacy vocabulary history is retained at source pending an explicit import mapping; no silent import. | P1 | State, due-review, validation, tenant isolation |
|
|
| Scoreline and admissions content | Education catalog, when selected | **Deferred.** No safe authoritative dataset or freshness contract is established. Existing legacy data is retained read-only; no endpoint compatibility is claimed. | P2 | Retirement/defer compatibility contract only |
|
|
| Video entitlement and progress | Entitlement owner unresolved; media delivery outside Education | **Explicitly retired from this wave.** No video endpoint, token, progress write, or metadata-based access bypass is added. Legacy video/progress data is retained until an entitlement-led child slice defines import and deletion policy. | P3 blocked | Capability manifest must expose no video interface |
|
|
| Recommendation and AI generation | AI public services plus Education authorization | **Explicitly deferred.** No student profile or learning history is sent to AI, and no AI recommendation endpoint is exposed. Legacy recommendation data remains retained but non-authoritative. | P3 blocked | Capability manifest must expose no AI interface |
|
|
| Notifications and reminders | Education schedule + System `NotifyMessageSendApi` | **Migrated for exam reminders.** Education owns claim/retry state; System owns message rendering/storage. A stable `education_exam_reminder` template is conditionally seeded. | P1 | Due claim, retry, tenant context, notify-port tests |
|
|
| Points, badges, check-ins, feedback, exam countdowns | Education orchestration + Member `MemberPointApi`; feedback/reminders/badge rules Education; System Notify | **Partially migrated.** Fixed server-side learning awards, configurable tenant badge definitions, automatic practice/vocabulary/feedback rules, lifetime-once manual grants, tenant-admin handling/audit, bounded resolved-feedback rewards, and exam reminder/countdown data are delivered. Generic check-in/task exchange and badge triggers that depend on not-yet-migrated check-in/mock-exam/activity domains remain deferred. | P1 bounded | Duplicate award/grant, invalid rule, optimistic conflict, notify failure, feedback ownership |
|
|
| Learning analytics, leaderboard, trends, reports | Education projections over immutable reports/vocabulary/awards | **Partially migrated.** Own summary and bounded tenant leaderboard are delivered. Leaderboard is anonymized and contains no user IDs or report details. Trend/export surfaces are deferred. | P1 bounded | Tenant isolation, deterministic ranking, redaction |
|
|
|
|
## Executable APIs
|
|
|
|
Student identity and tenant are always derived from the authenticated context; no API accepts `userId` or `tenantId`.
|
|
|
|
- Vocabulary progress/review: `/app-api/education/vocabulary/*`
|
|
- Exam reminder create/list/cancel: `/app-api/education/exam-reminders`
|
|
- Student feedback: `/app-api/education/learning/feedback`
|
|
- Learning award orchestration: `/app-api/education/learning/awards`
|
|
- Own learning summary: `/app-api/education/learning/summary`
|
|
- Anonymous tenant leaderboard: `/app-api/education/learning/leaderboard`
|
|
- Tenant-admin learning operations: `/admin-api/education/learning-operations/*`
|
|
- Student badge projection: `/app-api/education/engagement/badges`
|
|
- Tenant-admin badge definitions and grants: `/admin-api/education/badge/*`
|
|
- Scheduled dispatch bean: `examReminderSendJob` using System Notify public API
|
|
|
|
## Security and reversibility
|
|
|
|
- All Education state is tenant-owned and uses explicit tenant/user predicates in addition to framework interception.
|
|
- Client requests cannot choose point values, badge codes, notify templates, delivery users, or leaderboard tenant.
|
|
- Exam reminder delivery uses a token-fenced, expiring database claim. An interrupted `SENDING` row is reclaimed after lease expiry, attempts are bounded, and exhausted claims become observable `FAILED` rows through V4200.
|
|
- Award rows and reminder rows are durable retry authorities; cross-module tables are never written directly by Education application code.
|
|
- Education point calls use stable Member ledger business keys backed by V4250 uniqueness. Feedback rewards require `RESOLVED` state, a separate reward permission, and a bounded server-validated value.
|
|
- Badge definitions and automatic rules are tenant-owned. Badge grants reuse the Education award ledger, validate manual targets through Member, project administrators through System, and use a partial unique key for lifetime-once delivery. A failed System notification is recorded as `FAILED` without undoing the grant.
|
|
- Automatic badge rules can subscribe only to implemented Education events (`PRACTICE_SUBMIT`, `VOCABULARY_REVIEW`, `FEEDBACK_RESOLVED`); absent legacy domains are not represented as fake triggers.
|
|
- Leaderboard output uses deterministic tenant-local aliases and aggregate score only. No phone, profile, member ID, answer, explanation, feedback content, or report detail is exported.
|
|
- Rollback disables/removes executable application paths while retaining V4160 data. Destructive rollback is not provided; later correction uses a higher forward migration.
|
|
- Video and AI remain fail-closed: this wave exposes no executable interface and establishes no entitlement through access metadata.
|
|
|
|
## Acceptance evidence required before production rollout
|
|
|
|
- Focused unit/controller tests for each delivered family.
|
|
- Real PostgreSQL Flyway migration and tenant-isolation tests.
|
|
- Compile and migration packaging verification.
|
|
- Operational creation of the Quartz schedule for `examReminderSendJob`; V4160 provides state/template, not an environment-specific cron row.
|