# Learnitive Learn v2 — MasterStudy + Production Training Parity Audit

## Reference model

- **Base application:** Learnitive React + TypeScript + MySQL.
- **Course builder / curriculum / course page / player reference:** MasterStudy LMS.
- **Technical lesson authoring / playlist workflow reference:** supplied Laravel production training LMS.
- **Visual block-editing reference:** supplied Confluent editor implementation.
- **Historical content source:** supplied SPX production LMS dump.
- **Runtime/security source of truth:** Learnitive Universal Runner, Console Gateway, Docker sandboxes, auth and Free/Pro entitlement.
- **Brand treatment:** MasterStudy-style hierarchy and geometry using Learnitive yellow rather than MasterStudy blue.

## Builder and curriculum parity

Implemented and retained:

- `/admin/learn` course library and dedicated builder routes.
- top navigation: Curriculum, Drip, Settings, Pricing, FAQ, Notice.
- Settings navigation: Main, Access, Prerequisites, Course files, Course page, Certificate, Custom fields.
- dnd-kit curriculum sorting with keyboard support and cross-section movement.
- lesson, quiz, assignment and YouTube Playlist creation inside sections.
- item-level Free/Pro, duration, availability and enrollment-relative drip.
- categories, prerequisites with required progress percentages and cycle prevention, protected course files, course timing/expiration, course-page settings, certificates and custom fields.
- custom React dialogs throughout Learn/Admin; no native browser alert/confirm/prompt.

## Lesson authoring parity and improvements

Implemented visual authoring includes:

- separate wide author workspace and ~860px learner reading width.
- Editor.js toolbar gutter so slash/+ controls remain visible.
- nested semantic List rather than one-item-per-line strings.
- direct-edit Table with row/column/header controls.
- visual Tabs and Accordion with bounded nested lesson blocks.
- visual Checklist, Callout, Gallery, File, Audio, Image and Video workflows.
- managed media picker shared by supported media tools.
- pasted images upload once, appear immediately, retain dimensions and never persist base64 in lesson JSON.
- image sizing/alignment/caption/alt/replace/library controls.
- runnable Standard Code with filename, runtime, code, stdin and trusted Run output.
- visual Code Exercise with separate practice Run and authoritative Check, independent per-test stdin, visible/hidden tests, hints, protected solution and templates.
- first-class Terminal Task with persistent learner sandbox verification rather than a fresh stateless runner.

## Video and playlist parity

Implemented:

- uploaded video, YouTube, Wistia and safe direct HTTPS sources.
- one `LearnVideoPlayer` LMS-facing abstraction with yellow treatment, progress, completion threshold, resume, captions and credits.
- no arbitrary iframe HTML storage.
- YouTube Data API secret held in `/etc/learnitive/learnitive.env` and never returned to browser code.
- narrowly scoped root-owned secret helper instead of weakening the main service's `/etc/learnitive` read-only policy.
- `/admin/settings/integrations` with masked YouTube state/test/update flow.
- playlist URL/ID normalization, regex divider, Entire/Before/After/Matched extraction, ranges, prefixes, status/access/completion defaults, description/duration/thumbnail options and credits.
- unavailable source-position preservation and per-video selection.
- duplicate protection and ordinary editable lesson creation.
- playlist provenance, sync, changed-title/reorder/private/removed reporting, LMS-title preservation and disconnect-without-delete.

Plyr itself is not installed in this source snapshot because the current execution environment cannot install dependencies. The provider-neutral player boundary is implemented; dependency-backed build verification remains a mandatory deployment gate.

## Assessment security

- checkpoint answers are removed from learner lesson payloads.
- Code Exercise hidden tests and solutions are removed from learner lesson payloads.
- each Code Exercise visible/hidden test executes independently with its own stdin; hidden results return aggregates only.
- Terminal Task protected verifier records live outside normal public lesson JSON.
- Terminal Task attempts bind authenticated user + course + lesson + block + attempt to one exact project ID and sandbox generation.
- visual and advanced verifier commands run only through that attempt-scoped sandbox path with bounded timeout/output behavior.
- generic progress APIs cannot forge checkpoint, Code Exercise, Terminal or Terminal Task completion.
- quiz completion/scoring remains authoritative on the server.

## Course/public/player parity

`/learn` includes:

- search
- featured courses
- continue learning
- course cards with level, duration, item count, Free/Pro and progress

`/learn/:course` includes:

- hero/start card
- about/description
- outcomes
- prerequisites
- curriculum
- requirements
- details/custom fields
- protected course materials
- FAQ
- timing/access state and progress

`/learn/:course/:lesson` retains the immersive geometry:

- ~50px top header (`3.125rem`)
- ~360px curriculum sidebar (`22.5rem`)
- ~860px lesson reading body (`53.75rem`)
- ~50px bottom navigation
- mobile curriculum drawer
- previous/next/completion states
- interactive block rendering

## Server-side access parity

The server remains authoritative for:

- published/private course visibility
- Free/Pro course and item entitlement
- prerequisites
- available-from/expiration timing
- item absolute drip
- enrollment-relative drip
- sequential locking
- course-file access
- lesson-media access
- quiz scoring/timers/attempts
- Code Exercise completion
- Terminal Task completion

## SPX migration architecture

Historical SPX SQL is deliberately separated from the production web process:

SPX ZIP/SQL → `tools/spx-import/` → isolated temporary MySQL → normalization → streaming NDJSON/media package → `/admin/learn/import` → Learn v2.

The CLI does not write Learn production SQL or need production Learn DB credentials. `tools/spx-import/readme.txt` documents administrator operation and safety requirements.

Unknown/unsupported historical blocks are preserved as `legacyImport` repair blocks; raw preserved source is visible only to Admin and stripped from learner serialization.

## Runtime-validation policy

- `runtime_validation_required` remains removed.
- no Validate Runtime author workflow exists.
- course publish validation is structural only.
- learner execution still uses bounded trusted execution/sandbox infrastructure.

## Verification snapshot

Current schema: **55**.

Passed in the current execution environment:

- current-release audit **247/247**
- Learn/SPX/migration focused bundle **80/80**
- Learn security/parity gate **8/8**
- release hardening **42/42**
- SEO/index **25/25**
- release-quality, lock sync, dependency consistency, public barrels, public assets, namespace, brand and installer syntax gates

Blocked by environment and still mandatory before production-final certification:

- TypeScript/TSX compile and production browser build because dependencies are not installed and registry access is unavailable.
- representative/full SPX MySQL conversion/import because MySQL client/server is unavailable here.

No blocked gate is to be replaced with a fabricated lockfile, unsafe SQL parsing or a claim of unperformed verification.