TimeBack Curriculum Alpha Data Dictionary

new-course-ingest

API: POST Content /tenants/{tenantId}/alpha/content/imports/qti-package; for one primary object GET then PATCH /alpha/curriculum/v1/components/{lessonId}; for multiple items POST /alpha/curriculum/v1/components once per targeted child practice/review component; GET /alpha/curriculum/v1/components/{lessonId}/tree or GET /alpha/curriculum/v1/components?parentId={lessonId}

Provision a new course in owner order: import/admit its standards framework and use the returned framework identity in course standards_framework_refs; have the owning author create each missing governed registry KC with POST /alpha/curriculum/v1/kcs using stored_as=alpha.knowledge_component, definition, and optional provenance-only source_kc_id; retry only with the original Idempotency-Key or exact canonical kc_id, because source_kc_id never resolves an identity; capture and verify the returned canonical kc_id through GET /alpha/curriculum/v1/kcs/{kcId}; use only that exact UUID in prerequisite, scope, remediation, standards-map, and Content-attribution references. Write prerequisite ordering through POST /alpha/curriculum/v1/kc-prerequisites; write other typed graph semantics to alpha.kc_relation and standards links to alpha.standard_kc_map; never create KC containment. Import Content, then route each returned exact Content tuple {content_id, content_version_id, content_kind} from Curriculum after Content-owned release-eligibility succeeds. stored_as is a governed-authority assertion, not a physical-store selector. Migrated CASE/source ids are immutable evidence, never active read/retire aliases or UUID reference values. An ordinary scoped lesson preserves the producer-authored non-empty KC cluster and may carry many scope_kc_refs. When the producer explicitly decides that one content-bearing lesson has no authored KC attribution, POST /alpha/curriculum/v1/components sanctions only kind=lesson with the exact eligible target_ref, compatible renderer_ref, scope_kc_refs=[], and kc_scope_decision=authoritative_no_kc; Curriculum never substitutes a similarity, course-root, standards, or Content-tag binding. The accepted target cardinality is one course_component_member per ordered Content use. Until member routes are deployed, the CASE component compatibility adapter uses one stable targeted child practice/review component per additional item under the lesson; repeatedly PATCHing the lesson target replaces the prior direct target and is forbidden for many-item attachment. Standards import never mints KCs, Content kc-tags never encode lesson membership, and the frozen Content curriculum_node_id archive is not a current routing index.

Readback: The deployed compatibility BFF reads every targeted child from the lesson tree or parent-filtered component list; the target BFF reads member rows after verified cutover. Content /kc-tags may independently prove weighted item-to-KC attribution. GET Content items?curriculum_node_id=… remains historical archive compatibility only, has no automatic TTL, and receives no new placements.

curriculum_member_content_reference_gate_placement

timeback-source-ingest

API: POST /alpha/curriculum/v1/ingest/timeback-course-refs

Normalize only the courses → course_components → component_resources → resources boundary into course, reusable component, and ordered member rows. Resources pass through Content first, whose handoff must supply content_id, content_version_id, and content_kind; missing, malformed, mismatched, or ineligible exact versions fail closed and Curriculum never infers latest. Every lesson preserves its authored non-empty active kc_id cluster, including multi-KC scope; learning_objectives, standards, standard, and other standards-shaped evidence return curriculum:adapter_rejected and must use POST /alpha/curriculum/v1/standards-frameworks/import; course ingest never writes CASE standards or fabricates KCs; a source quiz is not a gate without explicit member gate fields.

Readback: Assembly writes deterministic identities as draft, verifies the exact intended tree, publishes components bottom-up, and publishes the course root last. Same-run retry upserts the same identities. Successful complete imports materialize readable course/component/member rows and become structurally routable only after root-last publication; launch still requires a matching immutable course approval, a complete firm active KC-version snapshot, and fresh exact Content eligibility. Source-empty or KC-unscoped known anchors return 409 curriculum:lesson_structure_missing; draft, retired, partially published, unapproved, or snapshot-incomplete graphs return 409 curriculum:course_not_routable and never skip forward.

curriculum_source_shaped_ingest_adapter

common-cartridge

API: POST /alpha/curriculum/v1/transports/common-cartridge/import and POST /alpha/curriculum/v1/transports/common-cartridge/preview

Import/export is transport over CASE standards, the course/component/member graph, and exact-version Content references. Produce bundles on demand and never store a cartridge as Curriculum authority.

curriculum_common_cartridge_transport_only

powerpath-100-lesson-mastery-v2

A PP100 gate binds one exact Content adaptive bank and this exact versioned policy. Curriculum owns placement and remediation routing but does not select a fixed form, choose a question, store a score, or decide mastery. Results freezes the exact eligible Content pool at attempt start, deterministically selects an unseen question from the current score band, applies the governed score walk, pauses the same attempt for remediation after 30 responses in one session, and resumes with score and history intact. Mastery and spaced-retrieval eligibility occur only at exactly 100; errors can set the score back but can never make mastery mathematically unreachable. At scores 90–99 only Content-calibrated hard questions at standardized-test rigor are eligible, with no downward fallback unless the owning blueprint marks the lesson prerequisite.

curriculum_mastery_gate_test_bank_reference

test-bank-next-form

This fixed-form route remains for non-PP100 gates and immutable historical PP100 v1 attempts. PP100 v2 never calls it: Results resolves the gate's exact pp100_adaptive_shards bank directly through the governed Content pool contract. Ordinary fixed-form learners launch only a published, complete gate whose exact bank and candidate form versions pass Content-owned release eligibility. Published gates always try that ordinary path first, and only an authoritative ineligible answer may enter Content's governed test-serve lane; timeouts, network errors, malformed answers, and target mismatches fail closed. Content's typed invalid-bank graph answers (content.invalid_test_bank_member_contract or content.bank_kc_attribution_incomplete) map immediately to HTTP 409 curriculum:invalid_content_bank_member_contract and can never enter test-serve, be treated as empty membership, or skip to a later form. A targetless draft rejects before Content reads, but a draft gate with a complete exact test_bank target may launch only when the exact student person_id is authorized by Content's demo-only grant plus live People & Orgs test/synthetic reality. Both fixed-form lanes evaluate at most 50 immutable exact members, require practice_eligible relationship and referenced-item scopes, and choose the same lowest-index unseen form. Test-serve additionally requires Content to atomically revalidate the exact bank/form membership and append an immutable authorization receipt before Curriculum returns serve_mode=test plus receipt/grant ids. A denied real identity keeps curriculum:invalid_gate_contract for a draft gate. Empty/oversized membership remains curriculum:invalid_gate_contract, no eligible forms remains curriculum:content_not_eligible, and only an eligible set with zero unseen forms is curriculum:bank_exhausted. Curriculum never substitutes latest, accepts a preview flag, or caches the test authorization.

curriculum_mastery_gate_test_bank_reference · curriculum_governed_test_identity_draft_gate_launch

primary-kc-coverage

Each blueprint item counts toward exactly one primary KC; secondary Q-matrix tags do not count twice. Standards breadth resolves the primary KC through alpha.standard_kc_map, never by substituting a standard for KC identity.

curriculum_ls_pin_item_kc_cardinality

comparable-forms-and-passing-loss

Fixed forms are comparable only when every hard blueprint constraint matches and item overlap is zero. passing_rule carries per-KC/gateway loss assumptions and defaults strict for prerequisite gates; numeric cuts stay in alpha.policy and the source corpus says 90%, not 89.5%.

curriculum_ls_pin_comparable_forms · curriculum_ls_pin_passing_rule_loss

Write-time referential integrity

• Every non-empty scope_kc_refs value and remediation_entries.kc_ref resolves exactly to an active tenant-owned alpha.knowledge_component.kc_id before any write; retired, cross-tenant, missing, CASE, source, or standards ids return a typed failure with no partial persistence. Multi-KC authored clusters are preserved. Registry-native POST /kcs is owner-only, accepts only stored_as=alpha.knowledge_component with definition, optional provenance-only source_kc_id, and no CASE fields; callers use its returned kc_id.
• An empty lesson scope is accepted only for a direct kind=lesson component with an exact eligible target_ref, a compatible registered renderer_ref, scope_kc_refs=[], and kc_scope_decision=authoritative_no_kc. Detail, tree, and next-lesson echo the decision and exact target; the lesson contributes an empty kc_version_snapshot and no mastery evidence. Omitted/unresolved scope and every inferred similarity, course-root, standards, or Content-tag binding remain forbidden.
• Parent/component/member references resolve tenant-locally without cycles.
• POST /components inserts a never-seen caller identity or transactionally reactivates the matching soft-retired CASE identity as draft while preserving created_at and advancing version; a successful 201 is never a normalization-only receipt and must be immediately readable with its new ETag.
• At authoring and ordinary launch, Content targets resolve through Content-owned release eligibility for the exact {content_id, content_version_id, content_kind}; every unavailable, malformed, mismatched, blocked, revoked, unresolved, or otherwise ineligible answer fails closed, and Curriculum never substitutes latest or stores copied producer evidence. The only launch exception is Content's demo-only governed test-serve lane: Curriculum supplies the exact student person_id, Content independently requires an active grant plus People & Orgs reality=test/synthetic, and no form is returned until Content appends an exact bank/form authorization receipt.
• renderer_ref resolves to an active capability accepting the target kind.
• entry_policy_ref, exit_policy_ref, and passing_criteria_ref resolve to versioned alpha.policy rows.
• Retirement that strands an active member is rejected unless the reference is repointed atomically.

curriculum:reference_unresolved

curriculum_authoring_referential_integrity

alpha.standards_source_release

Immutable checksum-addressed evidence for one retrieved source scope.

curriculum_immutable_standards_source_release

alpha.standards_source_row_binding

Lossless, one-release binding from each admitted source row/material to its CASE row.

curriculum_immutable_standards_source_release

alpha.standards_rights_record

Effective-dated material-level permission/admission decision with counsel provenance.

curriculum_immutable_standards_source_release

alpha.standards_readback_evidence

Immutable comparison proving release-bound CASE rows reproduce the source losslessly.

curriculum_immutable_standards_source_release

case.cf_document

Verbatim CASE framework identity and body; Curriculum adds no alternate standards text store.

curriculum_kc_registry_standard_separation

case.cf_item

Verbatim CASE standard statement. KCs and course components must never be stored here after cutover.

curriculum_kc_registry_standard_separation

case.cf_association

Within-framework containment and standard-to-standard alignment only.

curriculum_kc_registry_standard_separation

alpha.knowledge_component

Persistent, course-independent masterable identity; meaning lives in immutable versions.

curriculum_kc_registry_standard_separation · curriculum_kc_storage_governance

alpha.knowledge_component_version

Immutable authored KC meaning and reviewable definition quality.

curriculum_kc_storage_governance

alpha.kc_case_migration_snapshot

Immutable named source snapshot and reconciliation proof for the one-time #707 cutover.

curriculum_kc_storage_governance

alpha.kc_source_identity

Immutable #707 migration evidence mapping a captured source id to the canonical registry UUID.

curriculum_kc_registry_standard_separation · curriculum_kc_storage_governance

alpha.kc_case_migration_ledger

One immutable accepted/rejected disposition for every discovered #707 source object.

curriculum_kc_storage_governance

alpha.kc_prerequisite

Canonical directed acyclic prerequisite graph.

curriculum_kc_registry_standard_separation

alpha.kc_relation

Governed non-prerequisite semantic and lineage edges.

curriculum_kc_storage_governance

alpha.kc_review_decision

Immutable structured review audit for one KC version.

curriculum_kc_storage_governance

alpha.course

Stable reusable course identity, role, scope, lifecycle, and approval reference.

curriculum_reusable_component_member_model

alpha.course_component

Reusable student-independent structure/KC scope decision and expected-effort leaf/fallback.

curriculum_reusable_component_member_model

alpha.course_component_member

One ordered course-local use of a reusable component or exact Content version.

curriculum_reusable_component_member_model · curriculum_member_content_reference_gate_placement

alpha.component_target_repoint_audit

Immutable audit row for every accepted producer self-service repoint/attach of a component's exact Content pin.

curriculum_member_content_reference_gate_placement

alpha.course_approval

Immutable approval boundary pinning one reviewed course graph.

curriculum_kc_storage_governance

alpha.course_approval_kc_snapshot

Immutable exact KC-version set referenced by an approved course.

curriculum_kc_storage_governance

alpha.kc_firming_event

Immutable proof of the only two legal draft-to-firm transitions.

curriculum_kc_storage_governance

alpha.standard_kc_map

Release-pinned first-class standard-to-KC mapping with relationship, provenance, and confidence.

curriculum_kc_registry_standard_separation

alpha.named_kc_set_v

Read-only named projection without a stored KC containment tree.

curriculum_kc_registry_standard_separation

curriculum.component_sample

Non-authoritative sample contract retained only for the deployed CASE-backed conformance probe.

Do not generate target migrations, KC storage, course storage, or authoring guidance from this table.

curriculum_shared_supabase_migration_gate

Import, bind, verify, and admit a partial standards release

API: POST /alpha/curriculum/v1/standards-frameworks/import with Idempotency-Key; GET /alpha/curriculum/v1/standards-source-releases/{sourceReleaseId}/readback

-- The API resolves platform.idempotency_key before this transaction: an exact active request hash/protocol/server lease token owns mutation and finalization; terminal rows replay exact status/body/headers; live same-hash contenders return curriculum:idempotency_in_progress; different hashes return curriculum:idempotency_conflict.
BEGIN ISOLATION LEVEL SERIALIZABLE;
INSERT INTO alpha.standards_source_release (tenant_id,source_release_id,source_authority,official_source_url,declared_scope,partial_display_name,license_url,release_rights_status,required_attribution,retrieved_at,raw_artifact_sha256,raw_checksum_grain,parser_name,parser_version,normalized_artifact_ref,normalized_artifact_sha256,normalization_profile,source_policy_ref,imported_by,imported_at)
VALUES (:tenant_id,:release_id,:source_authority,:official_source_url,:declared_scope,:partial_display_name,:license_url,:release_rights_status,:required_attribution,:retrieved_at,:raw_sha256,:raw_checksum_grain,:parser_name,:parser_version,:normalized_artifact_ref,:normalized_sha256,:normalization_profile,:source_policy_ref,:imported_by,now())
;
INSERT INTO case.cf_document (tenant_id,id,identifier,body,retired_at) VALUES (:tenant_id,:document_id,:document_identifier,:document_body,NULL);
INSERT INTO case.cf_item (tenant_id,id,identifier,cf_document_id,body,retired_at) VALUES (:tenant_id,:item_id,:item_identifier,:document_id,:item_body,NULL);
INSERT INTO alpha.standards_source_row_binding (tenant_id,binding_id,source_release_id,source_row_key,material_grain,source_locator,source_identifier,case_resource_type,case_resource_id,raw_statement,normalized_statement,ordinal_path,binding_sha256,created_at) VALUES
(:tenant_id,:document_binding_id,:release_id,:document_source_row_key,'framework',:document_source_locator,:document_identifier,'cf_document',:document_id,:document_raw_title,:document_normalized_title,:document_ordinal_path,:document_binding_sha256,now()),
(:tenant_id,:item_binding_id,:release_id,:item_source_row_key,'statement',:item_source_locator,:item_identifier,'cf_item',:item_id,:item_raw_statement,:item_normalized_statement,:item_ordinal_path,:item_binding_sha256,now());
INSERT INTO alpha.standards_rights_record (tenant_id,rights_record_id,source_release_id,material_grain,material_ref,rights_status,admission_outcome,permission_basis,allowed_uses,required_attribution,effective_from,effective_to,source_policy_ref,evidence_ref,decided_by_role,counsel_decision_ref,created_at) VALUES
(:tenant_id,:release_rights_record_id,:release_id,'release',:release_id::text,:release_rights_status,:release_admission_outcome,:release_permission_basis,:release_allowed_uses,:release_required_attribution,:rights_effective_from,:rights_effective_to,:source_policy_ref,:release_evidence_ref,:release_decided_by_role,:release_counsel_decision_ref,now()),
(:tenant_id,:item_rights_record_id,:release_id,'statement',:item_source_row_key,:item_rights_status,:item_admission_outcome,:item_permission_basis,:item_allowed_uses,:item_required_attribution,:rights_effective_from,:rights_effective_to,:source_policy_ref,:item_evidence_ref,:item_decided_by_role,:item_counsel_decision_ref,now());
INSERT INTO alpha.standards_readback_evidence (tenant_id,evidence_id,source_release_id,binding_id,raw_sha256,normalized_sha256,readback_sha256,mismatch_code,mismatch_detail,checked_at,checker_version) VALUES
(:tenant_id,:document_evidence_id,:release_id,:document_binding_id,:raw_sha256,:normalized_sha256,:document_readback_sha256,:document_mismatch_code,:document_mismatch_detail,now(),:checker_version),
(:tenant_id,:item_evidence_id,:release_id,:item_binding_id,:raw_sha256,:normalized_sha256,:item_readback_sha256,:item_mismatch_code,:item_mismatch_detail,now(),:checker_version);
WITH scope_check AS (
  SELECT release.source_release_id,count(binding.binding_id) AS binding_count,
    jsonb_typeof(release.declared_scope)='object'
    AND NULLIF(release.declared_scope->>'jurisdiction','') IS NOT NULL
    AND NULLIF(release.declared_scope->>'subject','') IS NOT NULL
    AND NULLIF(release.declared_scope->>'edition','') IS NOT NULL
    AND jsonb_typeof(release.declared_scope->'grades')='array' AND jsonb_array_length(release.declared_scope->'grades')>0
    AND jsonb_typeof(release.declared_scope->'rowFilter')='string' AND NULLIF(release.declared_scope->>'rowFilter','') IS NOT NULL
    AND (release.declared_scope->>'expectedRowCount') ~ '^[1-9][0-9]*$'
    AND (release.declared_scope->>'sourceRowKeysSha256') ~ '^[0-9a-f]{64}$'
    AND (release.declared_scope->>'isPartial') IN ('true','false')
    AND NULLIF(release.declared_scope->>'officialFrameworkName','') IS NOT NULL
    AND CASE WHEN (release.declared_scope->>'expectedRowCount') ~ '^[1-9][0-9]*$' THEN (release.declared_scope->>'expectedRowCount')::bigint=count(binding.binding_id) ELSE false END
    AND release.declared_scope->>'sourceRowKeysSha256'=encode(digest(COALESCE(string_agg(binding.source_row_key,E'
' ORDER BY binding.source_row_key),''),'sha256'),'hex')
    AND ((release.declared_scope->>'isPartial')='false' AND release.partial_display_name IS NULL OR (release.declared_scope->>'isPartial')='true' AND NULLIF(release.partial_display_name,'') IS NOT NULL AND release.partial_display_name<>release.declared_scope->>'officialFrameworkName') AS scope_exact
  FROM alpha.standards_source_release release LEFT JOIN alpha.standards_source_row_binding binding ON binding.tenant_id=release.tenant_id AND binding.source_release_id=release.source_release_id
  WHERE release.tenant_id=:tenant_id AND release.source_release_id=:release_id
  GROUP BY release.source_release_id,release.declared_scope,release.partial_display_name
), ranked_rights AS (
  SELECT binding.binding_id,rights.rights_status,rights.admission_outcome,(rights.rights_status='public_domain' OR COALESCE(rights.required_attribution,release.required_attribution) IS NOT NULL) AS attribution_satisfied,count(*) OVER (PARTITION BY binding.binding_id,CASE WHEN rights.material_grain='release' THEN 'release' ELSE 'specific' END) AS active_at_specificity,row_number() OVER (PARTITION BY binding.binding_id ORDER BY CASE WHEN rights.material_grain='release' THEN 1 ELSE 2 END DESC,rights.effective_from DESC,rights.created_at DESC) AS precedence
  FROM alpha.standards_source_row_binding binding JOIN alpha.standards_source_release release ON release.tenant_id=binding.tenant_id AND release.source_release_id=binding.source_release_id JOIN alpha.standards_rights_record rights ON rights.tenant_id=binding.tenant_id AND rights.source_release_id=binding.source_release_id AND ((rights.material_grain=binding.material_grain AND rights.material_ref=binding.source_row_key) OR (rights.material_grain='release' AND rights.material_ref=binding.source_release_id::text)) AND rights.effective_from<=:evaluation_time AND (rights.effective_to IS NULL OR rights.effective_to>:evaluation_time)
  WHERE binding.tenant_id=:tenant_id AND binding.source_release_id=:release_id
), evidence_status AS (
  SELECT binding_id,count(*) AS evidence_count,bool_and(mismatch_code='none') AS all_pass,bool_or(mismatch_code<>'none') AS has_mismatch
  FROM alpha.standards_readback_evidence WHERE tenant_id=:tenant_id AND source_release_id=:release_id AND binding_id IS NOT NULL GROUP BY binding_id
), release_check AS (
  SELECT scope.binding_count,scope.scope_exact,count(DISTINCT evidence.binding_id) FILTER (WHERE evidence.evidence_count>0 AND evidence.all_pass) AS passing_readbacks,count(DISTINCT rights.binding_id) FILTER (WHERE rights.precedence=1 AND rights.active_at_specificity=1 AND rights.admission_outcome='green' AND rights.rights_status IN ('permitted','public_domain') AND rights.attribution_satisfied) AS green_rights,COALESCE(bool_or(rights.precedence=1 AND rights.active_at_specificity>1),false) AS has_rights_conflict,COALESCE(bool_or(rights.precedence=1 AND (rights.admission_outcome='red' OR rights.rights_status='prohibited')),false) AS has_red,COALESCE(bool_or(evidence.has_mismatch),false) AS has_any_mismatch
  FROM scope_check scope LEFT JOIN alpha.standards_source_row_binding binding ON binding.tenant_id=:tenant_id AND binding.source_release_id=scope.source_release_id LEFT JOIN evidence_status evidence ON evidence.binding_id=binding.binding_id LEFT JOIN ranked_rights rights ON rights.binding_id=binding.binding_id
  GROUP BY scope.binding_count,scope.scope_exact
)
SELECT CASE WHEN binding_count=0 OR NOT scope_exact OR has_any_mismatch OR has_red THEN 'red' WHEN has_rights_conflict THEN 'yellow' WHEN binding_count=passing_readbacks AND binding_count=green_rights THEN 'green' ELSE 'yellow' END AS admission_outcome,binding_count,scope_exact,passing_readbacks,green_rights,has_any_mismatch FROM release_check;
COMMIT;

Guardrails: Tenant predicate on every read/writeBounded serializationIdempotency replay happens before the transaction; every release-id collision abortsCanonical declared scope count + sorted row-key hash must equal every bindingEvery CASE row has one bindingEvery evidence row for every binding must passMost-specific effective rights winsOnly green becomes adoptable

Problems: curriculum:standards_scope_invalidcurriculum:rights_unresolvedcurriculum:standards_readback_mismatchcurriculum:idempotency_conflict

curriculum_immutable_standards_source_release

Author, version, review, relate, and crosswalk a KC

API: POST /alpha/curriculum/v1/kcs; POST /alpha/curriculum/v1/kcs/{kcId}/versions; POST /alpha/curriculum/v1/kc-prerequisites; POST /alpha/curriculum/v1/kc-relations; POST /alpha/curriculum/v1/kc-review-decisions; POST /alpha/curriculum/v1/standard-kc-maps

BEGIN ISOLATION LEVEL SERIALIZABLE;
SET CONSTRAINTS ALL DEFERRED;
-- Every prerequisite create, correction, and retirement acquires this same tenant-scoped transaction lock; serialization failures are retried with the same Idempotency-Key.
SELECT pg_advisory_xact_lock(hashtextextended('curriculum:kc-prerequisite:'||:tenant_id::text,0));
INSERT INTO alpha.knowledge_component (tenant_id,kc_id,source_kc_id,lineage_id,kc_kind,subject_id,current_version_id,publication_status,created_at,updated_at) VALUES (:tenant_id,:kc_id,:source_kc_id,:lineage_id,:kc_kind,:subject_id,:version_id,'draft',now(),now());
INSERT INTO alpha.knowledge_component_version (tenant_id,version_id,kc_id,version_number,status,definition,positive_examples,negative_examples,boundary_statement,misconceptions,instructional_classification,provenance,confidence,author_ref,created_at) VALUES (:tenant_id,:version_id,:kc_id,1,'draft',:definition,:positive_examples,:negative_examples,:boundary_statement,:misconceptions,:instructional_classification,:provenance,:confidence,:author_ref,now());
INSERT INTO alpha.kc_prerequisite (tenant_id,from_kc_id,to_kc_id,version,prerequisite_id,prerequisite_kc_id,dependent_kc_id,provenance,confidence,created_at,updated_at) SELECT :tenant_id,:prerequisite_kc_id,:kc_id,1,:edge_id,:prerequisite_kc_id,:kc_id,:edge_provenance,:edge_confidence,now(),now() WHERE NOT EXISTS (WITH RECURSIVE reach(kc_id) AS (SELECT dependent_kc_id FROM alpha.kc_prerequisite WHERE tenant_id=:tenant_id AND prerequisite_kc_id=:kc_id AND retired_at IS NULL UNION SELECT p.dependent_kc_id FROM alpha.kc_prerequisite p JOIN reach r ON p.prerequisite_kc_id=r.kc_id WHERE p.tenant_id=:tenant_id AND p.retired_at IS NULL) SELECT 1 FROM reach WHERE kc_id=:prerequisite_kc_id);
DO $$ BEGIN IF NOT EXISTS (SELECT 1 FROM alpha.kc_prerequisite WHERE tenant_id=:tenant_id AND prerequisite_id=:edge_id) THEN RAISE EXCEPTION 'curriculum:prerequisite_cycle'; END IF; END $$;
INSERT INTO alpha.kc_relation (tenant_id,relation_id,origin_kc_id,destination_kc_id,relation_type,provenance,confidence,created_at,updated_at) VALUES (:tenant_id,:relation_id,:kc_id,:related_kc_id,'applies_to',:relation_provenance,:relation_confidence,now(),now());
INSERT INTO alpha.kc_review_decision (tenant_id,review_decision_id,version_id,decision,edit_diff,rationale,provenance,actor_ref,decided_at) VALUES (:tenant_id,:review_id,:version_id,:decision,:edit_diff,:rationale,:review_provenance,:actor_ref,now());
INSERT INTO alpha.standard_kc_map (tenant_id,map_id,source_release_id,standard_binding_id,standard_id,kc_id,relationship,provenance,confidence,created_at,updated_at) VALUES (:tenant_id,:map_id,:source_release_id,:standard_binding_id,:standard_id,:kc_id,:relationship,:map_provenance,:map_confidence,now(),now());
COMMIT;

Guardrails: No CASE KC rowPOST /kcs is owner-only and accepts stored_as=alpha.knowledge_component only with definition, optional provenance-only source_kc_id, and no document_id, name, or containment field; create replay, GET, version, and retire accept the exact canonical kc_id onlysource_kc_id is never a create-or-resolve key: reusing it for a different or server-minted canonical kc_id returns a typed conflict without partial rows even when semantics match, and it never enables a later lookup/reference fallback; HTTP retries use the original Idempotency-KeySemantic source ids and the #707 crosswalk remain immutable evidence only and are never written into UUID reference fieldsEvery scope/remediation/graph reference is an active tenant registry UUIDSemantic edits appendEvery prerequisite mutation takes one tenant-scoped graph lock inside SERIALIZABLESerialization failures replay through Idempotency-Keyalpha.kc_prerequisite alone is acyclicalpha.kc_relation holds other typed non-DAG semanticsalpha.standard_kc_map pins release + bindingKCs have no containment treeSteward queues/monitoring are absent

Problems: curriculum:invalid_kc_kindcurriculum:kc_definition_qualitycurriculum:kc_semantics_conflictcurriculum:prerequisite_cyclecurriculum:invalid_kc_relationcurriculum:precondition_failed

curriculum_kc_authoring_contract

Approve a course, snapshot every KC version, and firm drafts atomically

API: POST /alpha/curriculum/v1/courses/{courseId}/approvals with Idempotency-Key

Integrator policy: An app integrator may invoke this workflow directly with its Platform-issued tenant-scoped credential. An ordinary course approval needs no per-course owner ruling.

Authorization: Bearer JWT with curriculum:write

Request body: {"approved_by":"integrator:ap-one","provenance":{"source":"ap-one:course-approval","course_ref":"{integratorCourseRef}"}}

Turnaround: The authorized approval transaction is synchronous. If the integrator lacks curriculum:write, request that narrow tenant credential through Platform tenant onboarding; this contract defines no credential-provisioning SLA and there is no per-course approval queue.

Preconditions:

• The course root is published and not retired.
• The current graph is complete and contains at least one governed KC reference.
• Every referenced KC is active, published, and resolves to its exact current immutable version.
• Each exact Content gate target has independently passed Content-owned trust and release eligibility before gate publication.

Readback:

• Require POST success to return the immutable approval with its complete exact KC-version snapshot.
• GET /alpha/curriculum/v1/courses/{courseId}/approvals and match the approval id and snapshot.
• GET /alpha/curriculum/v1/courses/{courseId}/next-lesson and require it to echo the current approval and firm snapshot; changed or incomplete graphs fail closed.

BEGIN ISOLATION LEVEL SERIALIZABLE;
SELECT course_id FROM alpha.course WHERE tenant_id=:tenant_id AND course_id=:course_id AND retired_at IS NULL FOR UPDATE;
CREATE TEMP TABLE _approval_scope (kc_id uuid PRIMARY KEY, version_id uuid NOT NULL, snapshot_source text NOT NULL) ON COMMIT DROP;
INSERT INTO _approval_scope (kc_id,version_id,snapshot_source)
SELECT kc.kc_id,kc.current_version_id,'course_component:'||min(component.component_id::text)
FROM alpha.course_component_member member
JOIN alpha.course_component component ON component.tenant_id=member.tenant_id AND component.component_id=member.target_component_id AND component.retired_at IS NULL
CROSS JOIN LATERAL unnest(component.scope_kc_ids) scoped(kc_id)
JOIN alpha.knowledge_component kc ON kc.tenant_id=component.tenant_id AND kc.kc_id=scoped.kc_id AND kc.retired_at IS NULL
WHERE member.tenant_id=:tenant_id AND member.course_id=:course_id AND member.target_kind='course_component' AND member.retired_at IS NULL
GROUP BY kc.kc_id,kc.current_version_id;
DO $$ BEGIN
  IF NOT EXISTS (SELECT 1 FROM _approval_scope) OR (SELECT count(*) FROM _approval_scope) <> (SELECT count(DISTINCT scoped.kc_id) FROM alpha.course_component_member member JOIN alpha.course_component component ON component.tenant_id=member.tenant_id AND component.component_id=member.target_component_id AND component.retired_at IS NULL CROSS JOIN LATERAL unnest(component.scope_kc_ids) scoped(kc_id) WHERE member.tenant_id=:tenant_id AND member.course_id=:course_id AND member.target_kind='course_component' AND member.retired_at IS NULL) THEN RAISE EXCEPTION 'curriculum:approval_snapshot_incomplete'; END IF;
END $$;
INSERT INTO alpha.course_approval (tenant_id,approval_id,course_id,course_graph_sha256,approved_by,approved_at,provenance) VALUES (:tenant_id,:approval_id,:course_id,:course_graph_sha256,:approved_by,now(),:provenance);
INSERT INTO alpha.course_approval_kc_snapshot (tenant_id,approval_id,kc_id,version_id,snapshot_source,created_at) SELECT :tenant_id,:approval_id,kc_id,version_id,snapshot_source,now() FROM _approval_scope;
DO $$ BEGIN IF (SELECT count(*) FROM _approval_scope) <> (SELECT count(*) FROM alpha.course_approval_kc_snapshot WHERE tenant_id=:tenant_id AND approval_id=:approval_id) THEN RAISE EXCEPTION 'curriculum:approval_snapshot_incomplete'; END IF; END $$;
INSERT INTO alpha.kc_firming_event (tenant_id,firming_event_id,version_id,firming_reason,source_ref,actor_ref,firmed_at) SELECT :tenant_id,gen_random_uuid(),snapshot.version_id,'course_approval','approval:'||:approval_id,:approved_by,now() FROM alpha.course_approval_kc_snapshot snapshot JOIN alpha.knowledge_component_version version ON version.tenant_id=snapshot.tenant_id AND version.version_id=snapshot.version_id WHERE snapshot.tenant_id=:tenant_id AND snapshot.approval_id=:approval_id AND version.status='draft' ON CONFLICT (tenant_id,version_id) DO NOTHING;
UPDATE alpha.knowledge_component_version version SET status='firm' FROM alpha.course_approval_kc_snapshot snapshot WHERE snapshot.tenant_id=:tenant_id AND snapshot.approval_id=:approval_id AND version.tenant_id=snapshot.tenant_id AND version.version_id=snapshot.version_id AND version.status='draft';
UPDATE alpha.course SET current_approval_id=:approval_id,updated_at=now() WHERE tenant_id=:tenant_id AND course_id=:course_id;
COMMIT;

Guardrails: Complete immutable snapshotFirm only exact snapshotted versionsNo publication/assignment firmingApproval and firming atomic

Problems: curriculum:approval_snapshot_incompletecurriculum:invalid_kc_lifecyclecurriculum:idempotency_conflict

curriculum_kc_storage_governance

Firm a draft KC version on the first genuine live response

API: POST /alpha/curriculum/v1/kc-firming-events with Idempotency-Key and body {version_id, firming_reason:'first_genuine_response', source_ref}

-- First obtain :validated_live_learning_evidence_ref from the Results/Events-owned contract; Curriculum rows cannot prove genuine traffic.
BEGIN ISOLATION LEVEL SERIALIZABLE;
SELECT status FROM alpha.knowledge_component_version WHERE tenant_id=:tenant_id AND version_id=:version_id FOR UPDATE;
INSERT INTO alpha.kc_firming_event (tenant_id,firming_event_id,version_id,firming_reason,source_ref,actor_ref,firmed_at) VALUES (:tenant_id,:event_id,:version_id,'first_genuine_response',:validated_live_learning_evidence_ref,:actor_ref,now()) ON CONFLICT (tenant_id,version_id) DO NOTHING;
UPDATE alpha.knowledge_component_version SET status='firm' WHERE tenant_id=:tenant_id AND version_id=:version_id AND status='draft' AND EXISTS (SELECT 1 FROM alpha.kc_firming_event WHERE tenant_id=:tenant_id AND version_id=:version_id AND firming_reason='first_genuine_response' AND source_ref=:validated_live_learning_evidence_ref);
COMMIT;

Guardrails: Explicit live_learning=trueFirst genuine response evidencePreview/developer traffic rejectedAt most one effective firming eventIdempotent replay

Problems: curriculum:invalid_kc_lifecyclecurriculum:live_learning_evidence_requiredcurriculum:idempotency_conflict

curriculum_kc_storage_governance

Reuse one lesson in two courses with independent order and behavior

API: POST /alpha/curriculum/v1/components; POST /alpha/curriculum/v1/courses/{courseId}/members (once per course)

BEGIN;
INSERT INTO alpha.course_component (tenant_id,component_id,kind,scope_kc_ids,name,description,expected_xp,lineage_id,publication_status,created_at,updated_at) VALUES (:tenant_id,:component_id,'lesson',ARRAY[:kc_id]::uuid[],:component_name,:component_description,:expected_xp,:lineage_id,'published',now(),now());
INSERT INTO alpha.course_component_member (tenant_id,member_id,course_id,parent_component_id,position,target_kind,target_component_id,content_id,content_version_id,content_kind,renderer_ref,gates,passing_criteria_ref,on_fail,created_at,updated_at) VALUES
(:tenant_id,:course_a_member_id,:course_a_id,:course_a_parent_id,:course_a_position,'course_component',:component_id,NULL,NULL,NULL,NULL,false,NULL,NULL,now(),now()),
(:tenant_id,:course_b_member_id,:course_b_id,:course_b_parent_id,:course_b_position,'course_component',:component_id,NULL,NULL,NULL,NULL,false,NULL,NULL,now(),now());
COMMIT;

Guardrails: One component identityTwo member identitiesOrder/renderer/gate are member-localLesson preserves its non-empty active KC cluster

Problems: curriculum:unknown_kccurriculum:invalid_component_kindcurriculum:member_position_conflict

curriculum_reusable_component_member_model

Create a member that targets one eligible exact Content version

API: GET Content exact-version release-eligibility; POST /alpha/curriculum/v1/courses/{courseId}/members

-- First require a 200 eligible response from GET /tenants/{tenantId}/alpha/content/items/{contentId}/versions/{contentVersionId}/release-eligibility and verify renderer_ref against the live capability registry. Raw Curriculum rows cannot infer either verdict.
INSERT INTO alpha.course_component_member (tenant_id,member_id,course_id,parent_component_id,position,target_kind,target_component_id,content_id,content_version_id,content_kind,renderer_ref,gates,passing_criteria_ref,on_fail,created_at,updated_at)
VALUES (:tenant_id,:member_id,:course_id,:parent_component_id,:position,'content_version',NULL,:validated_content_id,:validated_content_version_id,:validated_content_kind,:validated_renderer_ref,:gates,:passing_criteria_ref,:on_fail,now(),now());

Guardrails: Exact version, not latestContent owns eligibilityNo copied eligibility fieldsRenderer registry must accept content_kind404/unsupported fails closed

Problems: curriculum:content_not_eligiblecurriculum:content_unavailablecurriculum:content_version_mismatchcurriculum:invalid_content_bank_member_contractcurriculum:renderer_incompatible

curriculum_member_content_reference_gate_placement

Producer self-service repoint/attach of one exact Content pin

API: POST /alpha/curriculum/v1/components/{componentId}/repoint with Idempotency-Key

Integrator policy: A producer whose course already pins a Content identity repoints that pin to its amended exact version directly with its Platform-issued tenant-scoped curriculum:write credential; a platform re-pin ticket is not the steady-state path. operation=attach pins newly published content onto a component without a current pin. This endpoint exposes the same governed exact-version target update the platform's own repin corridor executes; it is not a new storage primitive.

Request body: {"operation":"repoint","expected_target_ref":{"module":"content","content_kind":"article","content_id":"{contentId}","content_version_id":"{currentlyPinnedVersionId}"},"target_ref":{"module":"content","content_kind":"article","content_id":"{contentId}","content_version_id":"{amendedVersionId}"}}

Preconditions:

• expected_target_ref is a compare-and-set premise: it must equal the component's exact current pin (attach requires null and an unpinned component); any drift is 409 curriculum:repoint_pin_stale with zero writes.
• A repoint keeps the Content identity: content_id and content_kind never change; a revision published under a new content_id is a NEW content identity and must be attached, never silently substituted (409 curriculum:repoint_identity_mismatch).
• The exact new version must pass Content-owned release eligibility with practice_eligible usage scope inside the accepting request; an authoritative refusal is 409 curriculum:repoint_target_not_serveable carrying the safe upstream cause, and an unavailable Content answer stays 503 curriculum:content_unavailable.
• A published component pinning an assessment chain (mastery_gate/quiz/test kinds, or test_bank/test/test_spec content kinds) is frozen: producer self-service returns 409 curriculum:approved_chain_repoint_frozen and the change goes through the reviewed-replacement manifest path — a committed reviewed manifest applied through the platform's dry-run-first ETag/CAS corridor.
• The component resolves only inside the verified JWT tenant; a cross-tenant id is an ordinary 404.

Readback:

• The 200 response returns the updated component plus its immutable alpha.component_target_repoint_audit row; the same Idempotency-Key replays the identical response with no second audit row.
• The repoint changes the course graph, so next-lesson fails closed (409 curriculum:course_not_routable) until the producer appends a new immutable approval through POST /alpha/curriculum/v1/courses/{courseId}/approvals; ordinary next-lesson must then echo the new approval and serve the exact repointed version.

BEGIN;
-- First require a 200 exact-version release-eligibility response with usage_scope='practice_eligible'
-- for :new_content_version_id from the owning Content API; raw Curriculum rows cannot infer that verdict.
SELECT member_id, content_id, content_version_id, content_kind, gates
  FROM alpha.course_component_member
 WHERE tenant_id=:tenant_id AND member_id=:member_id AND retired_at IS NULL
 FOR UPDATE;
DO $$ BEGIN
  IF NOT FOUND THEN RAISE EXCEPTION 'curriculum:not_found'; END IF;
END $$;
UPDATE alpha.course_component_member member
   SET content_version_id=:new_content_version_id, updated_at=now()
 WHERE member.tenant_id=:tenant_id AND member.member_id=:member_id AND member.retired_at IS NULL
   AND member.target_kind='content_version'
   AND member.gates=false
   AND member.content_kind NOT IN ('test_bank','test','test_spec')
   AND member.content_id=:expected_content_id
   AND member.content_kind=:expected_content_kind
   AND member.content_version_id IS NOT DISTINCT FROM :expected_content_version_id
   AND member.content_id=:new_content_id;
DO $$ BEGIN
  IF NOT EXISTS (SELECT 1 FROM alpha.course_component_member WHERE tenant_id=:tenant_id AND member_id=:member_id AND content_version_id=:new_content_version_id) THEN
    RAISE EXCEPTION 'curriculum:repoint_pin_stale';
  END IF;
END $$;
INSERT INTO alpha.component_target_repoint_audit (tenant_id, repoint_audit_id, component_id, operation, previous_target_ref, new_target_ref, actor_ref, request_id, created_at)
VALUES (:tenant_id, :repoint_audit_id, :member_id, :operation, :previous_target_ref, :new_target_ref, :actor_ref, :request_id, now());
COMMIT;
-- The deployed CASE compatibility adapter performs the identical operation on the component's
-- alpha.target_ref through the same normalized patch and CAS-guarded persistence as component PATCH.

Guardrails: Compare-and-set on the exact current pin, never last-writer-winsOne Content identity per repoint; attach only onto an unpinned componentContent owns exact-version eligibility and the check happens server-side inside the accepting requestApproved assessment chains freeze to the reviewed-replacement manifest pathOne immutable audit row per accepted operation in the same transactionIdempotency-Key replay returns the stored response without a second audit rowRouting stays fail-closed until a new immutable course approval covers the changed graph

Problems: curriculum:not_foundcurriculum:repoint_pin_stalecurriculum:repoint_identity_mismatchcurriculum:repoint_target_not_serveablecurriculum:approved_chain_repoint_frozencurriculum:content_unavailablecurriculum:content_version_mismatchcurriculum:renderer_incompatiblecurriculum:idempotency_conflict

curriculum_member_content_reference_gate_placement

Compute any course's expected XP without double-counting fallbacks

API: GET /alpha/curriculum/v1/courses/{courseId}/expected-xp

WITH RECURSIVE active_tree AS (
  SELECT member.tenant_id,member.course_id,member.member_id,member.target_component_id,component.expected_xp,ARRAY[member.member_id]::uuid[] AS member_path
  FROM alpha.course_component_member member JOIN alpha.course_component component ON component.tenant_id=member.tenant_id AND component.component_id=member.target_component_id AND component.retired_at IS NULL
  WHERE member.tenant_id=:tenant_id AND member.course_id=:course_id AND member.parent_component_id IS NULL AND member.target_kind='course_component' AND member.retired_at IS NULL
  UNION ALL
  SELECT child.tenant_id,child.course_id,child.member_id,child.target_component_id,component.expected_xp,parent.member_path||child.member_id
  FROM active_tree parent JOIN alpha.course_component_member child ON child.tenant_id=parent.tenant_id AND child.course_id=parent.course_id AND child.parent_component_id=parent.target_component_id AND child.target_kind='course_component' AND child.retired_at IS NULL
  JOIN alpha.course_component component ON component.tenant_id=child.tenant_id AND component.component_id=child.target_component_id AND component.retired_at IS NULL
  WHERE NOT child.member_id=ANY(parent.member_path)
), contributing AS (
  SELECT node.* FROM active_tree node WHERE node.expected_xp IS NOT NULL AND NOT EXISTS (SELECT 1 FROM active_tree descendant WHERE cardinality(descendant.member_path)>cardinality(node.member_path) AND descendant.member_path[1:cardinality(node.member_path)]=node.member_path AND descendant.expected_xp IS NOT NULL)
), cycle_check AS (
  SELECT EXISTS (SELECT 1 FROM active_tree parent JOIN alpha.course_component_member child ON child.tenant_id=parent.tenant_id AND child.course_id=parent.course_id AND child.parent_component_id=parent.target_component_id AND child.retired_at IS NULL WHERE child.member_id=ANY(parent.member_path)) AS cycle_detected
)
SELECT CASE WHEN cycle_check.cycle_detected THEN NULL ELSE COALESCE(sum(contributing.expected_xp),0) END AS expected_xp,course.course_role,(course.course_role='main') AS included_in_results_grade_denominator,cycle_check.cycle_detected
FROM cycle_check JOIN alpha.course course ON course.tenant_id=:tenant_id AND course.course_id=:course_id AND course.retired_at IS NULL LEFT JOIN contributing ON true
GROUP BY course.course_role,cycle_check.cycle_detected;

Guardrails: Every active course role returns its own totalContainer ignored when descendant has expected_xpFallback contributes only without valued descendantActive member paths onlyMain role only for the separate Results grade denominatorNo student actuals

Problems: curriculum:lesson_structure_missingcurriculum:expected_xp_ambiguous

curriculum_reusable_component_member_model

Import source-shaped TimeBack course structure without fabricating pedagogy

API: POST /alpha/curriculum/v1/ingest/timeback-course-refs with Idempotency-Key

BEGIN;
CREATE TEMP TABLE _source_components (source_component_id uuid PRIMARY KEY,source_kind text NOT NULL,scope_kc_ids uuid[] NOT NULL,source_name text NOT NULL,expected_xp numeric,lineage_id uuid NOT NULL) ON COMMIT DROP;
INSERT INTO _source_components SELECT * FROM jsonb_to_recordset(:validated_source_components::jsonb) AS source(source_component_id uuid,source_kind text,scope_kc_ids uuid[],source_name text,expected_xp numeric,lineage_id uuid);
CREATE TEMP TABLE _ordered_members (member_id uuid PRIMARY KEY,parent_component_id uuid,source_position integer NOT NULL,target_kind text NOT NULL,target_component_id uuid,content_id uuid,content_version_id uuid,content_kind text,renderer_ref text,gates boolean NOT NULL,passing_criteria_ref text,on_fail jsonb) ON COMMIT DROP;
INSERT INTO _ordered_members SELECT * FROM jsonb_to_recordset(:validated_ordered_members::jsonb) AS member(member_id uuid,parent_component_id uuid,source_position integer,target_kind text,target_component_id uuid,content_id uuid,content_version_id uuid,content_kind text,renderer_ref text,gates boolean,passing_criteria_ref text,on_fail jsonb);
DO $$ BEGIN
  IF EXISTS (SELECT 1 FROM _source_components WHERE source_kind='lesson' AND cardinality(scope_kc_ids)=0) OR EXISTS (SELECT 1 FROM _source_components source CROSS JOIN LATERAL unnest(source.scope_kc_ids) scoped(kc_id) LEFT JOIN alpha.knowledge_component kc ON kc.tenant_id=:tenant_id AND kc.kc_id=scoped.kc_id AND kc.retired_at IS NULL WHERE kc.kc_id IS NULL) THEN RAISE EXCEPTION 'curriculum:adapter_rejected'; END IF;
  IF EXISTS (SELECT 1 FROM _ordered_members WHERE source_position<0 OR target_kind NOT IN ('course_component','content_version') OR (target_kind='course_component' AND (target_component_id IS NULL OR content_id IS NOT NULL OR content_version_id IS NOT NULL OR content_kind IS NOT NULL)) OR (target_kind='content_version' AND (target_component_id IS NOT NULL OR content_id IS NULL OR content_version_id IS NULL OR content_kind IS NULL OR renderer_ref IS NULL)) OR gates<>(passing_criteria_ref IS NOT NULL)) THEN RAISE EXCEPTION 'curriculum:adapter_rejected'; END IF;
END $$;
INSERT INTO alpha.course (tenant_id,course_id,subject_id,grade_scope,course_role,name,lineage_id,publication_status,created_at,updated_at) VALUES (:tenant_id,:course_id,:subject_id,:grade_scope,:course_role,:course_name,:course_lineage_id,'draft',now(),now()) ON CONFLICT (tenant_id,course_id) DO UPDATE SET subject_id=excluded.subject_id,grade_scope=excluded.grade_scope,course_role=excluded.course_role,name=excluded.name,lineage_id=excluded.lineage_id,publication_status='draft',updated_at=now();
INSERT INTO alpha.course_component (tenant_id,component_id,kind,scope_kc_ids,name,expected_xp,lineage_id,publication_status,created_at,updated_at) SELECT :tenant_id,source_component_id,source_kind,scope_kc_ids,source_name,expected_xp,lineage_id,'draft',now(),now() FROM _source_components ON CONFLICT (tenant_id,component_id) DO UPDATE SET kind=excluded.kind,scope_kc_ids=excluded.scope_kc_ids,name=excluded.name,expected_xp=excluded.expected_xp,lineage_id=excluded.lineage_id,publication_status='draft',updated_at=now();
INSERT INTO alpha.course_component_member (tenant_id,member_id,course_id,parent_component_id,position,target_kind,target_component_id,content_id,content_version_id,content_kind,renderer_ref,gates,passing_criteria_ref,on_fail,created_at,updated_at) SELECT :tenant_id,member_id,:course_id,parent_component_id,source_position,target_kind,target_component_id,content_id,content_version_id,content_kind,renderer_ref,gates,passing_criteria_ref,on_fail,now(),now() FROM _ordered_members ON CONFLICT (tenant_id,member_id) DO UPDATE SET course_id=excluded.course_id,parent_component_id=excluded.parent_component_id,position=excluded.position,target_kind=excluded.target_kind,target_component_id=excluded.target_component_id,content_id=excluded.content_id,content_version_id=excluded.content_version_id,content_kind=excluded.content_kind,renderer_ref=excluded.renderer_ref,gates=excluded.gates,passing_criteria_ref=excluded.passing_criteria_ref,on_fail=excluded.on_fail,updated_at=now();
DO $$ BEGIN
  IF (SELECT count(*) FROM _source_components) <> (SELECT count(*) FROM alpha.course_component component JOIN _source_components source ON source.source_component_id=component.component_id WHERE component.tenant_id=:tenant_id AND component.publication_status='draft') OR (SELECT count(*) FROM _ordered_members) <> (SELECT count(*) FROM alpha.course_component_member member JOIN _ordered_members source ON source.member_id=member.member_id WHERE member.tenant_id=:tenant_id AND member.course_id=:course_id AND member.retired_at IS NULL) THEN RAISE EXCEPTION 'curriculum:publication_incomplete'; END IF;
END $$;
CREATE TEMP TABLE _intended_tree (component_id uuid PRIMARY KEY,depth integer NOT NULL) ON COMMIT DROP;
WITH RECURSIVE intended_tree AS (
  SELECT component.component_id,0 AS depth FROM alpha.course_component component JOIN alpha.course_component_member member ON member.tenant_id=component.tenant_id AND member.target_component_id=component.component_id WHERE component.tenant_id=:tenant_id AND member.course_id=:course_id AND member.parent_component_id IS NULL AND member.target_kind='course_component' AND member.retired_at IS NULL
  UNION ALL
  SELECT child.component_id,parent.depth+1 FROM intended_tree parent JOIN alpha.course_component_member member ON member.tenant_id=:tenant_id AND member.course_id=:course_id AND member.parent_component_id=parent.component_id AND member.target_kind='course_component' AND member.retired_at IS NULL JOIN alpha.course_component child ON child.tenant_id=member.tenant_id AND child.component_id=member.target_component_id
)
INSERT INTO _intended_tree SELECT component_id,max(depth) FROM intended_tree GROUP BY component_id;
DO $$ DECLARE publish_depth integer; BEGIN
  FOR publish_depth IN SELECT DISTINCT depth FROM _intended_tree ORDER BY depth DESC LOOP
    UPDATE alpha.course_component component SET publication_status='published',updated_at=now() FROM _intended_tree tree WHERE component.tenant_id=:tenant_id AND component.component_id=tree.component_id AND tree.depth=publish_depth;
  END LOOP;
END $$;
DO $$ BEGIN
  IF NOT EXISTS (SELECT 1 FROM alpha.course_component_member member JOIN alpha.course_component component ON component.tenant_id=member.tenant_id AND component.component_id=member.target_component_id WHERE member.tenant_id=:tenant_id AND member.course_id=:course_id AND member.retired_at IS NULL AND component.kind IN ('lesson','review','practice','mastery_gate')) OR EXISTS (SELECT 1 FROM alpha.course_component_member member JOIN alpha.course_component component ON component.tenant_id=member.tenant_id AND component.component_id=member.target_component_id WHERE member.tenant_id=:tenant_id AND member.course_id=:course_id AND (member.retired_at IS NOT NULL OR component.retired_at IS NOT NULL OR component.publication_status<>'published')) THEN RAISE EXCEPTION 'curriculum:publication_incomplete'; END IF;
END $$;
UPDATE alpha.course SET publication_status='published',updated_at=now() WHERE tenant_id=:tenant_id AND course_id=:course_id;
COMMIT;

Guardrails: Dry-run firstDeterministic same-run upsert identitiesEvery course/component is draft before assembly writesExact intended-tree readback precedes publicationPublish descendants bottom-up and the course root lastAny write/readback/publish failure rolls back or leaves the root draftPreserve source parentage and orderContent resolves resource bodies first and returns the exact versionNever infer latest or copy Content eligibility evidenceExact Content release eligibility is required at authoring and launchEvery lesson has a non-empty active KC cluster and multi-KC scope is preservedStandards evidence returns curriculum:adapter_rejected and never writes CASE rowsQuiz label alone does not create a gateSource-empty anchors stay non-routable

Problems: curriculum:validation_failedcurriculum:adapter_rejectedcurriculum:lesson_structure_missingcurriculum:publication_incompletecurriculum:content_not_eligiblecurriculum:content_unavailablecurriculum:content_version_mismatchcurriculum:invalid_content_bank_member_contractcurriculum:idempotency_conflict

curriculum_source_shaped_ingest_adapter

Resolve placement candidates from a versioned Policy reference

API: GET /alpha/curriculum/v1/tracks/{trackId}/placement-candidates?studentId=:student_id&subjectId=:subject_id

SELECT m.member_id,m.position,m.target_component_id,c.entry_policy_ref FROM alpha.course c JOIN alpha.course_component_member m ON m.tenant_id=c.tenant_id AND m.course_id=c.course_id AND m.retired_at IS NULL WHERE c.tenant_id=:tenant_id AND c.course_id=:track_id AND c.retired_at IS NULL ORDER BY m.position,m.member_id; -- Apply the returned versioned entry_policy_ref through Policy/Results; MAP/RIT may seed the start only.

Guardrails: Tenant scopeActive ordered membersPolicy owns the algorithm/numbersMAP/RIT is not final placementStudent state stays in Results

Problems: curriculum:not_foundcurriculum:reference_unresolvedcurriculum:unsupported_query_parameter

curriculum_five_use_cases

Route to the next active instructional member

API: GET /alpha/curriculum/v1/courses/{courseId}/next-lesson?studentId=:student_id&subjectId=:subject_id

WITH RECURSIVE course_root AS (
  SELECT course_id,publication_status,retired_at FROM alpha.course WHERE tenant_id=:tenant_id AND course_id=:course_id
), tree AS (
  SELECT m.tenant_id,m.course_id,m.member_id,m.parent_component_id,m.position,m.target_kind,m.target_component_id,ARRAY[m.position]::integer[] AS position_path,ARRAY[m.member_id]::uuid[] AS member_path,(m.retired_at IS NULL AND component.publication_status='published' AND component.retired_at IS NULL) AS ancestor_publication_safe
  FROM alpha.course_component_member m JOIN alpha.course_component component ON component.tenant_id=m.tenant_id AND component.component_id=m.target_component_id
  WHERE m.tenant_id=:tenant_id AND m.course_id=:course_id AND m.parent_component_id IS NULL AND m.target_kind='course_component'
  UNION ALL
  SELECT child.tenant_id,child.course_id,child.member_id,child.parent_component_id,child.position,child.target_kind,child.target_component_id,parent.position_path||child.position,parent.member_path||child.member_id,(parent.ancestor_publication_safe AND child.retired_at IS NULL AND component.publication_status='published' AND component.retired_at IS NULL)
  FROM alpha.course_component_member child JOIN tree parent ON child.tenant_id=parent.tenant_id AND child.course_id=parent.course_id AND child.parent_component_id=parent.target_component_id JOIN alpha.course_component component ON component.tenant_id=child.tenant_id AND component.component_id=child.target_component_id
  WHERE child.target_kind='course_component' AND NOT child.member_id=ANY(parent.member_path)
), first_frontier AS (
  SELECT tree.member_id,tree.position,tree.position_path,tree.target_component_id,component.kind,component.scope_kc_ids,component.kc_scope_decision,tree.ancestor_publication_safe
  FROM tree JOIN alpha.course_component component ON component.tenant_id=tree.tenant_id AND component.component_id=tree.target_component_id
  WHERE component.kind IN ('lesson','review','practice','mastery_gate') ORDER BY tree.position_path,tree.member_id LIMIT 1
)
SELECT frontier.member_id,frontier.position,frontier.position_path,frontier.target_component_id,frontier.kind,frontier.scope_kc_ids,frontier.kc_scope_decision
FROM course_root root CROSS JOIN first_frontier frontier
WHERE root.publication_status='published' AND root.retired_at IS NULL AND frontier.ancestor_publication_safe;
-- Results supplies completed/current state; choose the first eligible row there, never in Curriculum storage.

Guardrails: Tenant + active-row predicatesChoose the first frontier before publication filtering so an unpublished node is never skippedCourse root, selected frontier, and every containment ancestor must be published and not retiredCurrent graph must match an immutable approval with a complete exact firm KC-version snapshot for every scoped KCThe exact Content target is revalidated through Content-owned release eligibility at launch and latest is never substitutedDraft, retired, changed, unapproved, incomplete, unavailable, malformed, mismatched, or ineligible state fails closedLexicographic ancestor position_path preserves sibling-local hierarchy orderCycle paths are rejectedAn ordinary lesson has a non-empty active KC cluster and preserves multi-KC scope; an exact content-bearing lesson may instead echo scope_kc_ids=[] plus kc_scope_decision=authoritative_no_kc and contributes no KC snapshot or mastery evidenceResults supplies student stateMissing authoritative members fails closed

Problems: curriculum:not_foundcurriculum:lesson_structure_missingcurriculum:course_not_routablecurriculum:content_not_eligiblecurriculum:content_unavailablecurriculum:content_version_mismatchcurriculum:invalid_content_bank_member_contractcurriculum:unsupported_query_parameter

curriculum_five_use_cases

Read a gate contract and typed remediation without client classification

API: GET /alpha/curriculum/v1/gates/{gateId}/status?studentId=:student_id; GET /alpha/curriculum/v1/gates/{gateId}/remediation?studentId=:student_id&resultRecordId=:result_id

SELECT m.member_id,m.passing_criteria_ref,m.on_fail,m.content_id,m.content_version_id,m.content_kind FROM alpha.course_component_member m WHERE m.tenant_id=:tenant_id AND m.member_id=:gate_id AND m.gates=true AND m.retired_at IS NULL; -- Resolve passing_criteria_ref through Policy and result_id through Results. Return on_fail entries exactly; never persist the student's inserted remediation path in Curriculum.

Guardrails: Gate behavior is member-localPolicy numbers are referencedResults outcomes are read, not copiednever_learned→lessonforgot→reviewcareless→practice

Problems: curriculum:not_foundcurriculum:invalid_gate_contractcurriculum:reference_unresolved

curriculum_five_use_cases

Select the lowest-index unseen eligible form for a fixed-form gate

API: GET /alpha/curriculum/v1/gates/{gateId}/next-form?studentId=:student_id

WITH base_gate AS (
  SELECT content_id,content_version_id FROM alpha.course_component_member WHERE tenant_id=:tenant_id AND member_id=:gate_id AND gates=true AND content_kind='test_bank' AND retired_at IS NULL
), content_eligible_versions AS (
  -- Populate from 200 ordinary exact-version release-eligibility responses, or for one Content-authorized
  -- demo test identity from current test-serve eligibility responses. Test mode returns only after
  -- Content appends the exact bank/form authorization receipt.
  SELECT content_id,content_version_id FROM jsonb_to_recordset(:validated_content_eligible_versions::jsonb) AS eligible(content_id text,content_version_id text)
), eligible_gate AS (
  SELECT gate.* FROM base_gate gate JOIN content_eligible_versions eligible ON eligible.content_id=gate.content_id::text AND eligible.content_version_id=gate.content_version_id::text
), raw_bank_members AS (
  -- Read every active row for the exact bank version before applying scope or eligibility filters.
  -- LEFT JOINs keep missing targets visible so malformed legacy rows cannot disappear.
  SELECT r.content_reference_id,r.referenced_content_artifact_id AS referenced_content_id,
         r.referenced_content_version_id AS referenced_version_id,r.form_index,r.usage_scope,
         referenced_ext.usage_scope AS referenced_usage_scope,
         CASE referenced_artifact.artifact_kind WHEN 'test' THEN 'test' WHEN 'item' THEN 'question' ELSE NULL END AS content_kind,
         referenced_test.assessment_role
  FROM alpha.content_reference r
  JOIN platform.tenant tenant ON tenant.tenant_id=r.tenant_id
  JOIN eligible_gate gate ON r.parent_content_artifact_id=gate.content_id AND r.parent_content_version_id=gate.content_version_id
  LEFT JOIN qti.artifact referenced_artifact ON referenced_artifact.tenant_id=r.tenant_id AND referenced_artifact.artifact_id=r.referenced_content_artifact_id
  LEFT JOIN alpha.content_item_extension referenced_ext ON referenced_ext.tenant_id=r.tenant_id AND referenced_ext.content_artifact_id=r.referenced_content_artifact_id
  LEFT JOIN alpha.assessment_test_extension referenced_test ON referenced_test.tenant_id=r.tenant_id AND referenced_test.content_artifact_id=r.referenced_content_artifact_id
  WHERE tenant.tenant_key=:tenant_key AND r.relationship_kind='bank_member' AND r.retired_at IS NULL
  ORDER BY r.form_index ASC NULLS LAST,r.content_reference_id
  LIMIT 51
), bank_member_contract AS (
  SELECT count(*) AS member_count,
         count(*) FILTER (WHERE content_kind IS DISTINCT FROM 'test' OR assessment_role IS DISTINCT FROM 'form' OR referenced_content_id IS NULL OR referenced_version_id IS NULL OR form_index IS NULL OR form_index<=0) AS malformed_count,
         count(form_index)-count(DISTINCT form_index) AS duplicate_form_index_count
  FROM raw_bank_members
), candidate_forms AS (
  SELECT member.referenced_content_id,member.referenced_version_id,member.form_index
  FROM raw_bank_members member CROSS JOIN bank_member_contract contract
  WHERE contract.malformed_count=0 AND contract.duplicate_form_index_count=0
    AND member.usage_scope='practice_eligible' AND member.referenced_usage_scope='practice_eligible'
), eligible_forms AS (
  SELECT candidate.* FROM candidate_forms candidate JOIN content_eligible_versions eligible ON eligible.content_id=candidate.referenced_content_id AND eligible.content_version_id=candidate.referenced_version_id
), seen_forms AS (
  SELECT data->>'content_id' AS content_id,data->>'content_version_id' AS content_version_id
  FROM alpha.result_content_evidence
  WHERE tenant_id=:tenant_key AND data->>'student_id'=:student_id
), unseen_forms AS (
  SELECT form.* FROM eligible_forms form LEFT JOIN seen_forms seen ON seen.content_id=form.referenced_content_id AND seen.content_version_id=form.referenced_version_id WHERE seen.content_id IS NULL
), next_form AS (
  SELECT * FROM unseen_forms ORDER BY form_index,referenced_content_id LIMIT 1
)
SELECT (SELECT count(*) FROM base_gate) AS gate_count,(SELECT count(*) FROM eligible_gate) AS eligible_gate_count,contract.member_count,contract.malformed_count,contract.duplicate_form_index_count,(SELECT count(*) FROM candidate_forms) AS candidate_count,(SELECT count(*) FROM eligible_forms) AS eligible_count,(SELECT count(*) FROM unseen_forms) AS unseen_count,next_form.referenced_content_id,next_form.referenced_version_id,next_form.form_index
FROM bank_member_contract contract LEFT JOIN next_form ON true;
-- Before scope filtering or form eligibility, map malformed_count>0 or duplicate_form_index_count>0 to curriculum:invalid_content_bank_member_contract. Map gate_count=0 to curriculum:not_found, eligible_gate_count=0 to curriculum:content_not_eligible, member_count=0 or >50 to curriculum:invalid_gate_contract, eligible_count=0 to curriculum:content_not_eligible, and eligible_count>0 plus unseen_count=0 to curriculum:bank_exhausted. Never synthesize form_index from display_order or row position, and never return an empty 200.

Guardrails: PP100 v2 gates reject this fixed-form route because Results owns adaptive question selection from the exact pp100_adaptive_shards bankTargetless drafts fail before Content and membership readsA complete exact-bank draft is limited to Content's demo grant plus live People & Orgs test/synthetic realityPublished gates try ordinary release eligibility first; only authoritative ineligibility can enter test-serveContent invalid-bank contract answers map to the typed Curriculum 409 and never enter test-serve, appear empty, or skipTransport, timeout, malformed, and target-mismatch outcomes fail closedContent owns exact-version bank membershipRead and validate every active exact-bank row before applying usage-scope or eligibility filtersEach member must be an exact assessment_role=form test with a unique positive integer form_indexNever coalesce or synthesize form_index from display_order or row positionPin parent_content_id + parent_version_idThe bank version and every candidate form version must each pass the selected Content eligibility laneTest mode commits an immutable exact bank/form Content receipt before returnBoth Content usage scopes must be practice_eligibleResults owns seen-form evidenceStable ascending form_indexNever client-chosen or header-enabledMissing, ineligible, malformed, invalid-bank, and exhausted are distinct

Problems: curriculum:not_foundcurriculum:invalid_gate_contractcurriculum:content_not_eligiblecurriculum:content_unavailablecurriculum:invalid_content_bank_member_contractcurriculum:bank_exhausted

curriculum_mastery_gate_test_bank_reference

Preview or import a Common Cartridge without creating a second store

API: POST /alpha/curriculum/v1/transports/common-cartridge/preview; POST /alpha/curriculum/v1/transports/common-cartridge/import with Idempotency-Key

SELECT c.course_id,m.member_id,m.position,m.target_kind,m.target_component_id,m.content_id,m.content_version_id FROM alpha.course c JOIN alpha.course_component_member m ON m.tenant_id=c.tenant_id AND m.course_id=c.course_id AND m.retired_at IS NULL WHERE c.tenant_id=:tenant_id AND c.course_id=:course_id AND c.retired_at IS NULL ORDER BY m.position,m.member_id; -- Join CASE standards and Content package bytes through their owning dictionaries to build/validate the transport; do not INSERT a cartridge authority row.

Guardrails: Transport onlyNo stored cartridge authorityStable identifiersCASE/Curriculum/Content owners remain separateImport is idempotent

Problems: curriculum:transport_invalidcurriculum:reference_unresolvedcurriculum:idempotency_conflict

curriculum_common_cartridge_transport_only

Read a named KC-set projection

API: GET /alpha/curriculum/v1/kc-sets/{setId}

SELECT set_id,set_kind,name,kc_id,version_id,ordinal,source_ref FROM alpha.named_kc_set_v WHERE tenant_id=:tenant_id AND set_id=:set_id ORDER BY ordinal NULLS LAST,kc_id;

Guardrails: Read-onlyDeterministic source projectionNo stored KC parent/treeSet membership does not imply prerequisite order

Problems: curriculum:not_foundcurriculum:unsupported_query_parameter

curriculum_kc_registry_standard_separation

Discover the adaptive-eligible KC corpus from the owning registry

API: GET /alpha/curriculum/v1/kcs; GET /alpha/curriculum/v1/kcs/{kcId}

SELECT kc.kc_id,kc.lineage_id,kc.kc_kind,kc.subject_id,kc.current_version_id,kc.publication_status,version.version_number,version.status,version.definition FROM alpha.knowledge_component kc JOIN alpha.knowledge_component_version version ON version.tenant_id=kc.tenant_id AND version.version_id=kc.current_version_id WHERE kc.tenant_id=:tenant_id AND kc.retired_at IS NULL AND kc.current_version_id IS NOT NULL ORDER BY kc.updated_at DESC,kc.kc_id LIMIT :limit;

Guardrails: The registry is the single KC owner: adaptive-diagnostics consumers (for example AlphaTest adaptive_diagnostic blueprints) discover Knowledge Components here, never from case.cf_item or a CASE package, and no KC row is ever copied or relabeled into the standards catalogAdaptive-eligible means an active owner-typed registry KC: retired rows and the retained unclassified #707 legacy adoption row (kc_kind NULL, no current version) are never discoverable and never adaptive-eligibleEvery returned identity is the canonical kc_id UUID and reads back through GET /alpha/curriculum/v1/kcs/{kcId}; superseded legacy CASE KC rows remain immutable migration evidence onlyCASE package/framework identity for standards remains the contained CFDocument.identifier per official CASE 1.1; KC discovery never mints a CASE package identityStable updated_at desc, kc_id asc order with an opaque server-issued cursor; unsupported query parameters and malformed cursors fail closed

Problems: curriculum:unsupported_query_parametercurriculum:validation_failed

curriculum_kc_registry_standard_separation