Data dictionary for the shared QTI persistence schema

Stable database identifier for one customer/workspace boundary. This is the value module tables reference and tenant-scoped JWTs must match.

Edge case: QTI reconciliation must preserve existing qti.tenant tenant_id values or provide a deterministic mapping table during migration.

Must be a valid PostgreSQL UUID and unique as the primary key.

Invalid when: Not parseable as UUID, reused by another tenant, copied into learner-facing content as identity text, or replaced by tenant_key in foreign keys.

PITD-003 required tenant_id in platform.tenant. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

Referenced by platform.idempotency_key.tenant_id, platform.audit_log.tenant_id, and future module tenant_id fields. One tenant has many module records.

Example: 0d4ce2f4-1c42-4f3c-9f0d-03fb7f5271d3

Human-stable lookup key for routes, local tooling, logs, and examples. It is a convenience key, not an authorization secret.

Edge case: A renamed school may keep its tenant_key stable and update display_name instead; changing tenant_key is a migration because URLs and examples may depend on it.

3 to 64 characters. Lowercase ASCII letters, digits, and hyphens only. Must start and end with a letter or digit. Unique across platform.tenant.

Invalid when: Blank, uppercase, contains spaces, contains an email/domain secret, duplicates another tenant, or is used as proof of authorization.

QTI's qti.tenant.tenant_key pattern promoted into platform tenant lookup. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

No foreign keys should point at tenant_key; use tenant_id for joins.

Example: north-valley

Customer-facing label shown in admin tools and documentation examples.

Edge case: The name may contain a school or district name. Do not store student, parent, or teacher contact details here.

1 to 160 visible characters after trimming. Required. Must not be used for uniqueness, routing, authorization, or joins.

Invalid when: Null, blank, over 160 characters, used as an authorization key, or copied into module records instead of joining to platform.tenant.

PITD-003 required display_name in platform.tenant. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

None. It describes the tenant row and can change without changing tenant_id.

Example: North Valley School District

Tenant lifecycle state that tells modules whether ordinary tenant-scoped writes may proceed.

Edge case: Suspended and archived tenants can still be read by authorized support or export flows if the customer website documents that behavior.

Must satisfy tenant_status_allowed: provisioning, active, suspended, or archived.

Invalid when: Outside tenant_status, null, or manually changed without an audit row explaining the administrative action.

Allowed values: Platform tenant_status

PITD-003 left status to the data dictionary; PITD-005 and PITD-009 require auditable tenant scope. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

No foreign key. Modules read this before accepting customer writes.

Example: active

Small redacted operational facts about the tenant that do not deserve first-class columns yet.

Edge case: If a metadata key becomes required for authorization, billing, or module behavior, promote it to a typed column through a new data-dictionary attempt and migration.

Must be a JSON object. Recommended top-level keys are region, externalRefs, notes, and featureFlags. Must not contain secrets, raw JWTs, direct learner/parent PII, raw package bytes, IP addresses, or user agents.

Invalid when: Null, non-object JSON, stores a student email/phone/name/SIS ID, stores credentials, or becomes the only place a required module relationship is recorded.

PITD-003 required metadata; PITD-008 limits PII in shared tables. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

None. External references inside metadata are diagnostic and cannot replace tenant_id joins.

Example: {"region":"us-east","externalRefs":[{"system":"crm","ref":"acct_7x9"}]}

Timestamp when the tenant row was inserted.

Edge case: Bulk migrations from qti.tenant may preserve an older source created_at only when the migration notes explain the source.

Required timestamp with time zone. Stored in UTC by PostgreSQL/Supabase conventions.

Invalid when: Null, manually backdated without migration evidence, or compared as local wall time.

PITD-017 requires DDL comments and lifecycle timestamps. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

None.

Example: 2026-05-21T12:00:00Z

Timestamp when the tenant row was last changed.

Edge case: Audit rows remain the detailed history; updated_at is only the latest-row freshness indicator.

Required timestamp with time zone. Must be greater than or equal to created_at. Updated on every display_name, status, or metadata change.

Invalid when: Null, earlier than created_at, or left unchanged after a tenant status or metadata mutation.

PITD-017 requires forward-only migrations and observable shared state. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

None.

Example: 2026-05-21T12:00:00Z

Stable identifier for the retry ledger row. Audit rows refer to this value rather than repeating replay internals.

Edge case: This is an internal row id; the externally supplied key is idempotency_key.

Must be a valid PostgreSQL UUID and unique as the primary key.

Invalid when: Not a UUID, reused across rows, or exposed as the customer Idempotency-Key header value.

PITD-007 requires a shared retry ledger. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

Referenced by platform.audit_log.idempotency_key_id. One idempotency row can explain many audit rows for retries and final outcomes.

Example: b81db6f4-c7ea-4757-b5aa-87570f7ad119

Tenant that owns the retry scope and the mutation being protected.

Edge case: Platform-wide maintenance operations that do not have a tenant must not use this table unless the operation is deliberately scoped to a tenant row.

Must reference platform.tenant(tenant_id).

Invalid when: Null, not found in platform.tenant, or different from the tenant_id claim in the Bearer JWT for a tenant-scoped route.

PITD-007 defines tenant_id as part of idempotency scope. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

Many idempotency rows belong to one platform.tenant.

Example: 0d4ce2f4-1c42-4f3c-9f0d-03fb7f5271d3

Module namespace whose operation claimed the idempotency key.

Edge case: module=qti remains valid identity for QTI-owned retry scopes while qti/1edtech is under_reconciliation. Public registries must separately expose module_release_status and must not advertise QTI 1EdTech as approved until loop/qti/state.json says the surface has re-approved.

Must satisfy module_key_allowed: platform, qti, oneroster, caliper, case, nweamap, ed_fi, people_and_orgs, curriculum, content, events, results, analytics.

Invalid when: Null, outside module_key, used to store a route group instead of the module namespace, or used by /platform/modules as a release-status substitute.

Allowed values: Platform module_key

PITD-002 requires module schemas and shared platform operational tables. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

Pairs with surface, route_template, and operation_id to define replay scope.

Example: qti

Surface whose API contract produced the retryable operation.

Edge case: The platform surface uses module=platform and surface=platform.

Must satisfy surface_code_allowed: platform, 1edtech, or alpha.

Invalid when: Null, outside surface_code, or used to hide whether an Alpha divergence changed operation behavior.

Allowed values: Platform surface_code

PITD-015 defines platform, 1EdTech, and Alpha surfaces. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

Pairs with module so qti/1edtech and qti/alpha operations can have different customer contracts over shared persistence.

Example: 1edtech

HTTP method for the mutation protected by the key.

Edge case: PUT/PATCH operations that can overwrite user work still need If-Match or an equivalent validator; idempotency does not replace optimistic concurrency.

Must satisfy mutation_http_method_allowed: POST, PUT, PATCH, or DELETE.

Invalid when: Null, GET, lowercase if the implementation normalizes to uppercase, or method does not match the documented endpoint.

Allowed values: Platform mutation_http_method

PITD-007 defines retryable create, upload, import, export-job, and command operations. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

Part of the unique retry scope. Same route and key under different mutation methods are distinct scopes.

Example: POST

Stable route pattern from the customer website or OpenAPI operation, with variable path segments expressed as braces.

Edge case: If the Alpha route names the tenant as workspaceId, the template still uses the public Alpha route name documented by that surface.

Must start with /. Must not contain a query string. Path variables use {name}. Must not include concrete tenant IDs, resource IDs, learner refs, or secrets.

Invalid when: Contains concrete UUIDs, query strings, raw learner refs, access tokens, or an undocumented internal route.

PITD-006 requires endpoint-local contracts and PITD-007 requires route template scope. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

Part of the unique retry scope; links the row back to a documented endpoint.

Example: /tenants/{tenant_id}/qti/packages

Stable operation identifier used by docs, OpenAPI, logs, audit, and idempotency middleware.

Edge case: If two routes intentionally share replay behavior, they still need separate operation_id values unless the architecture explicitly declares them equivalent.

1 to 120 characters. Lowercase letters, digits, dots, underscores, and hyphens. Must be stable across wording-only documentation edits.

Invalid when: Blank, generated from a localized title, contains spaces, or changes without a customer-site and implementation update.

PITD-010 and PITD-009 require shared operation_id fields. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

Part of the unique retry scope and repeated in audit rows.

Example: qti.packages.import

Opaque customer-supplied Idempotency-Key header value for one retryable operation.

Edge case: Same key with same request_hash replays; same key with different request_hash returns 409.

1 to 128 printable ASCII characters after trimming. Unique within the tenant/module/surface/method/route_template/operation_id scope. Must not be a token, password, email, phone number, student identifier, or raw request hash.

Invalid when: Blank, reused for different request_hash in the same scope, contains credentials or direct learner PII, or exceeds the documented length.

QTI package ingest used Idempotency-Key; PITD-007 promotes the rule. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

Part of the unique retry scope. Not a foreign key.

Example: pkg-upload-2026-05-21-001

Digest of the canonical replay identity for the first request. It lets middleware distinguish a safe retry from key reuse with different content.

Edge case: Large uploads hash normalized bytes or a precomputed payload hash, never raw bytes stored in this table.

Must be sha256:<64 lowercase hex characters>. Hash input is method, normalized route template, canonical JSON/body digest, tenant_id, module, surface, operation_id, and any idempotency-relevant headers documented by the endpoint.

Invalid when: Missing algorithm prefix, not sha256, uppercase/malformed hex, computed from non-canonical JSON, or includes raw secrets in a way that would be logged.

PITD-007 requires request hash conflict detection. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

No foreign key. Compared with later requests in the same unique scope.

Example: sha256:3d9f7a3a4e3c7ff4a2dcb2de9339f3c5a9b4f7d58f0a20d6f127f452e4f7e8b1

Replay lifecycle state of the idempotency row.

Edge case: failed_transient rows can be taken over after locked_until if no side effect committed; failed_permanent rows replay the safe Problem response.

Must satisfy idempotency_status_allowed.

Invalid when: Outside idempotency_status, null, or incompatible with response_status/locked_until, such as completed with no final status.

Allowed values: Platform idempotency_status

PITD-007 requires original outcome replay and conflict behavior. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

No foreign key. Determines whether middleware replays, rejects, waits, or allows takeover.

Example: completed

HTTP status originally returned for a final replayable outcome.

Edge case: 204 outcomes store response_status=204 and response_body=null.

Nullable while in_progress or failed_transient. When present, must be an integer from 100 through 599 and match the stored response_body/resource outcome.

Invalid when: Present while status is in_progress, outside 100-599, or does not match the Problem/status or resource creation outcome.

PITD-006 defines HTTP status policy and PITD-007 defines replay. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

No foreign key. Used with response_body to replay the original result.

Example: 201

Redacted JSON body safe to replay to the same tenant for completed or failed_permanent outcomes.

Edge case: For async operations, response_body can be a 202 job resource even though final module processing continues elsewhere.

Nullable. When present, must be a JSON object or array that matches the documented response schema. Must not include secrets, raw package bytes, headers, access tokens, IP addresses, user agents, direct learner PII, or unredacted processing traces.

Invalid when: Stores raw request body, file bytes, secrets, PII, non-JSON text, or a body that cannot be returned to the authenticated tenant.

PITD-006 requires redacted Problem/errors; PITD-007 requires replayable outcomes. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

May contain resource identifiers that point into module tables, but the module table remains source of record.

Example: {"packageId":"7f2e4dd2-c147-49ea-af77-41a6fdd70980","importStatus":"imported"}

Optional type of resource created, imported, deleted, or accepted by the operation.

Edge case: For operations that create multiple resources, store the primary customer-visible resource and put redacted counts in response_body or audit metadata.

Nullable. When present, use a stable table or API object path such as qti.content_package, qti.delivery_session, platform.tenant, or alpha.activity.

Invalid when: Contains a display title, localized wording, raw URL, or path with tenant/resource IDs.

PITD-009 uses resource_type in audit and replay support. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

Pairs with resource_id for audit and support lookup. Does not enforce a foreign key because target tables vary by module.

Example: qti.content_package

Optional identifier of the primary resource associated with the replayable outcome.

Edge case: Async accepted work can use a job/run id here while the final content resource appears later in module tables.

Nullable. When present, must be the canonical resource identifier for resource_type and tenant_id.

Invalid when: Contains a student name, email, phone number, raw package path, or ID outside the tenant.

PITD-009 requires resource identifiers for operational traceability. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

Pairs with resource_type; target cardinality is many idempotency rows may point at one resource only when retries or aliases are documented.

Example: 7f2e4dd2-c147-49ea-af77-41a6fdd70980

Request identifier of the first request that claimed this key.

Edge case: Retry requests have their own request_id in access logs, but this field stays fixed to the first attempt.

Required non-empty text, 1 to 120 characters. Must be safe for logs and customer support. Must not contain tokens, IP addresses, user agents, or PII.

Invalid when: Null, blank, regenerated on replay, or includes sensitive request details.

PITD-010 requires request_id in structured operational evidence. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

Should match platform.audit_log.request_id for the original attempt when that attempt is audited.

Example: req_20260521_0001

Temporary lock deadline used while an in-progress operation is executing.

Edge case: Long-running async jobs should complete the idempotency row with a 202 response rather than hold this lock for the whole job.

Nullable. When status is in_progress, should be a future timestamp. Must be null for completed and failed_permanent rows.

Invalid when: Expired while status remains in_progress without takeover logic, set on completed rows, or earlier than created_at.

PITD-007 centralizes replay and conflict behavior. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

No foreign key. Used by middleware to decide whether another worker may take over a stale in-progress row.

Example: 2026-05-21T12:01:30Z

Timestamp after which the key is no longer promised to replay the original response.

Edge case: Expired rows may remain queryable for audit but must not silently replay after the documented window.

Required timestamp with time zone. Must be later than created_at. Default policy is at least 24 hours after first claim; modules may document longer windows for async jobs or exports.

Invalid when: Null, before created_at, shorter than the customer website promises, or extended without retention/audit reason.

PITD-007 requires a shared idempotency policy rather than per-module drift. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

Indexed for cleanup and expiry marking.

Example: 2026-05-22T12:01:00Z

Timestamp when the first request claimed the idempotency key.

Edge case: Use created_at plus expires_at for replay-window reporting.

Required timestamp with time zone.

Invalid when: Null, changed after insert, or compared without timezone normalization.

PITD-017 requires lifecycle timestamps. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

None.

Example: 2026-05-21T12:01:00Z

Timestamp when the row last changed status, replay body, lock, or expiry.

Edge case: Retries that merely read/replay do not need to update updated_at unless the implementation records replay counts elsewhere.

Required timestamp with time zone. Must be greater than or equal to created_at.

Invalid when: Null, earlier than created_at, or left unchanged after finalizing the row.

PITD-017 requires DDL discipline and auditability. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

None.

Example: 2026-05-21T12:01:08Z

Stable identifier for one append-only audit event.

Edge case: Corrections never update this row; write a later audit event that references the corrected resource.

Must be a valid PostgreSQL UUID and unique as the primary key.

Invalid when: Not a UUID, reused, or generated outside the database without collision safeguards.

PITD-009 required audit_log_id. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

No child table in this dictionary; support tools and future evidence exports may reference it.

Example: a597b7de-b1dd-4c9e-93a3-9623cb90bc34

Tenant affected by the audited action.

Edge case: Authenticated authorization denials should use the route tenant after checking it is a real platform.tenant row; missing-auth events stay in security logs, not tenant audit rows.

Must reference platform.tenant(tenant_id). Cross-tenant maintenance must emit one row per affected tenant rather than a tenantless row.

Invalid when: Null, not found, copied from an untrusted path without JWT tenant validation, or used to record a resource outside the tenant.

PITD-009 required tenant_id and PITD-005 requires tenant scope enforcement. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

Many audit rows belong to one platform.tenant.

Example: 0d4ce2f4-1c42-4f3c-9f0d-03fb7f5271d3

Module responsible for the operation being audited.

Edge case: Service-role maintenance that changes QTI records still uses module=qti even while qti/1edtech is under_reconciliation; release readiness belongs to module_release_status in the registry. CASE standards-browser maintenance still uses module=case unless the action changes only platform.* rows.

Must satisfy module_key_allowed: platform, qti, oneroster, caliper, case, nweamap, ed_fi, people_and_orgs, curriculum, content, events, results, analytics.

Invalid when: Null, outside module_key, set to platform for module resource changes, or used by support tooling as proof that the module surface is approved.

Allowed values: Platform module_key

PITD-002 defines module boundaries and PITD-009 requires module in audit rows. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

Pairs with surface and operation_id for operational reporting.

Example: case

Surface through which the action was initiated or exposed.

Edge case: Background jobs spawned by an Alpha request keep surface=alpha if the customer contract and audit trail originate there.

Must satisfy surface_code_allowed.

Invalid when: Null, outside surface_code, or set to alpha for expert-only conformance mutation.

Allowed values: Platform surface_code

PITD-015 defines surface model and derivation. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

Pairs with module and operation_id.

Example: 1edtech

Stable operation identifier from the customer website, OpenAPI, or platform maintenance command.

Edge case: Maintenance operation IDs should be named, such as platform.tenants.backfill-qti-view, not generic maintenance.

1 to 120 characters. Lowercase letters, digits, dots, underscores, and hyphens. Must match the documented operation whenever an API route triggered the row.

Invalid when: Blank, derived from localized prose, inconsistent with the endpoint that produced the event, or changed without docs and tests.

PITD-009 and PITD-010 require operation_id for audit and observability. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

Same naming convention as platform.idempotency_key.operation_id.

Example: qti.packages.import

Pseudonymous actor identifier for the user, service, or release process that attempted the action.

Edge case: For service-role operations use service:<operation-or-system>, and record narrow roles/scopes in actor_roles.

Required non-empty text. Use an HMAC/hash or stable opaque subject such as userhash:<hex> or service:<name>. Must not be a name, email, phone number, raw JWT subject, access token, SIS ID, or parent/student contact detail.

Invalid when: Contains @, phone-like text, direct student/parent/teacher name, raw JWT sub, Bearer token, or service credentials.

PITD-008 requires pseudonymous learner/customer data in logs and audit rows. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

No foreign key. Correlates with auth logs only through redacted identity systems.

Example: userhash:1bd7b5bd0d77

Roles or scopes that justified the action or explain why authorization failed.

Edge case: An empty array is allowed only when actor_subject is a known service identity and operation_id explains the maintenance path.

Required array. Values should be lowercase scope/role slugs. Must not include tokens, emails, names, or tenant secrets.

Invalid when: Null, contains raw JWT claims with PII, includes access tokens, or omits the service-role scope for privileged operations.

PITD-005 requires explicit roles/scopes for privileged operations. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

No foreign key in this dictionary; auth systems remain outside durable audit scope.

Example: {teacher,content-admin}

Stable resource class affected by the action.

Edge case: For collection-level denials use a collection type such as qti.content_package with resource_id='unresolved'.

Required text. Use a table path or public object path such as platform.tenant, qti.content_package, alpha.activity, or qti.conformance_run. Must not include concrete IDs.

Invalid when: Blank, localized title, raw URL, or includes tenant/resource IDs.

PITD-009 required resource_type. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

Pairs with resource_id. No database foreign key because target resource tables vary.

Example: qti.content_package

Identifier of the primary resource affected by the action, or a documented sentinel when authorization failed before resource resolution.

Edge case: For import operations, resource_id may be the accepted package/job id while module tables later attach child resources.

Required text, 1 to 160 characters. Use the canonical resource ID for resource_type. Use unresolved only for authorization denials before a resource can be safely looked up.

Invalid when: Blank, direct learner PII, access token, raw path with query secrets, or an ID from another tenant.

PITD-009 required resource_id. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

Pairs with resource_type for support queries.

Example: 7f2e4dd2-c147-49ea-af77-41a6fdd70980

Behavioral category of the audited action.

Edge case: When one request performs multiple high-risk actions, write multiple audit rows rather than collapsing them into a generic action.

Must satisfy audit_action_allowed.

Invalid when: Null, outside audit_action, or too vague to distinguish import from create, delete from runtime_delete, or read from read_privileged.

Allowed values: Platform audit_action

PITD-009 defines action semantics. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

No foreign key. Used with outcome for reporting and incident review.

Example: import

Final result category for the action.

Edge case: Async operations start with accepted; later completion can be represented by a module state change and, when high-risk, another audit row.

Must satisfy audit_outcome_allowed.

Invalid when: Null, outside audit_outcome, inconsistent with http_status, or hides authorization failure as validation failure.

Allowed values: Platform audit_outcome

PITD-009 requires outcome and PITD-006 defines status/error policy. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

No foreign key. Should align with http_status.

Example: succeeded

HTTP status returned for the request or the HTTP-equivalent status assigned to a background/service operation.

Edge case: For non-HTTP maintenance, use the status the platform would return from the equivalent command API.

Required integer from 100 through 599. Must align with outcome: 2xx for accepted/succeeded, 403 for failed_authorization, 400 for failed_validation, 409/412/428 for failed_conflict, 404 for failed_not_found, and 5xx for failed_server.

Invalid when: Null, outside 100-599, or inconsistent with outcome.

PITD-006 defines HTTP status policy; PITD-009 requires http_status. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

No foreign key. Matches customer-visible Problem/status when the action came from an API route.

Example: 201

Per-request identifier exposed in Problem responses and support logs.

Edge case: Retries have separate request_id values even when they reuse an idempotency row.

Required non-empty text, 1 to 120 characters. Must be safe to return to customers. Must not include IP addresses, user agents, auth headers, or PII.

Invalid when: Null, blank, contains request headers/secrets, or changes within the same request flow.

PITD-006 requires requestId in Problem errors and PITD-010 requires structured logs. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

May match platform.idempotency_key.first_request_id for first attempts.

Example: req_20260521_0001

Trace identifier that links logs, metrics, audit rows, and downstream spans for one request or job.

Edge case: If no distributed tracer is present, set trace_id equal to request_id until tracing is installed.

Required non-empty text, 1 to 160 characters. Use W3C traceparent-derived or platform trace ids. Must not include secrets or direct identity data.

Invalid when: Null, blank, contains auth tokens, or is regenerated per row inside the same request flow.

PITD-010 requires trace_id in structured logs and audit evidence. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

Can appear on multiple audit rows and logs in the same request/job.

Example: trace_20260521_a1f4

Optional link to the idempotency row that governed the audited operation.

Edge case: On idempotency conflict, the audit row may point at the existing idempotency_key_id while outcome=failed_conflict.

Nullable. When present, must reference platform.idempotency_key(idempotency_key_id). Set null for operations that do not use Idempotency-Key.

Invalid when: Not a UUID, points to a different tenant, or stores the customer-supplied header value instead of the internal row id.

PITD-007 and PITD-009 connect retry behavior to audit. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

Many audit rows may refer to one platform.idempotency_key row.

Example: b81db6f4-c7ea-4757-b5aa-87570f7ad119

Timestamp when the audited action reached the recorded outcome.

Edge case: For async accepted work, occurred_at is acceptance time; final job completion has its own module state and possible audit row.

Required timestamp with time zone. Stored in UTC by database convention.

Invalid when: Null, manually backdated without maintenance evidence, or compared as local time.

PITD-009 required occurred_at. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

Used with tenant_id and resource lookup indexes.

Example: 2026-05-21T12:01:08Z

Small, safe, structured context that helps explain the audit event without storing raw sensitive data.

Edge case: For validation failures, store safe error codes and field names, not the full rejected payload.

Must be a JSON object. Allowed content includes counts, hashes, profile names, version numbers, safe problem codes, and redacted summaries. Must not include raw request bodies, tokens, learner names, emails, phone numbers, SIS IDs, raw package bytes, IP addresses, user agents, or direct PII.

Invalid when: Null, non-object JSON, stores secrets/PII/raw bodies, or becomes the only place a required relationship is stored.

PITD-008 and PITD-009 require redacted audit metadata. Inherited into QTI by ITD-025; do not redefine this field in qti.*.

Platform shared, ITD-025 Platform Substrate Inheritance

No foreign key. If a metadata field becomes query-critical, promote it to a typed column in a later dictionary attempt.

Example: {"packageHash":"sha256:6a8c1f58c16f4b0b4f0a0d8c6be8d226e3d5d80f0b2f7d2f49e6d7d9e9d4f1cb","resourceCount":18}

Stable platform.tenant identifier exposed through the legacy qti.tenant shape.

Must match one platform.tenant(tenant_id). Do not create a separate qti.tenant-owned UUID sequence.

Invalid when: Not parseable as UUID, absent from platform.tenant, generated independently by QTI, or copied into QTI XML as assessment content.

Compatibility projection of platform.tenant.tenant_id.

ITD-008 Tenant Boundary, ITD-025 Platform Substrate Inheritance

One qti.tenant compatibility row maps to exactly one platform.tenant row.

Example: 0d4ce2f4-1c42-4f3c-9f0d-03fb7f5271d3

Human-stable platform.tenant lookup key exposed through the legacy QTI projection.

Must follow platform.tenant.tenant_key rules: 3 to 64 lowercase ASCII letters, digits, and hyphens; starts and ends with a letter or digit; unique in platform.tenant.

Invalid when: Duplicated, empty, uppercase, contains spaces, treated as an authorization secret, treated as a QTI identifier, or confused with the route-level demo tenantId alias.

Compatibility projection of platform.tenant.tenant_key.

ITD-008 Tenant Boundary, ITD-025 Platform Substrate Inheritance

No foreign keys should point at tenant_key; use tenant_id against platform.tenant.

Example: north-valley

Customer-facing platform.tenant label exposed for older QTI tools.

Must match platform.tenant.display_name: required 1 to 160 visible characters after trimming.

Invalid when: Null, blank, over 160 characters, used as authorization, or used in place of tenant_id for joins.

Compatibility projection of platform.tenant.display_name.

ITD-008 Tenant Boundary, ITD-025 Platform Substrate Inheritance

None. Join by tenant_id; display_name may change without changing tenant identity.

Example: North Valley School District

Timestamp when the backing platform.tenant row was inserted.

Required timestamp with time zone inherited from platform.tenant. It is read through qti.tenant, not owned by QTI.

Invalid when: Null, manually backdated without platform audit evidence, or compared as local time without timezone normalization.

Compatibility projection of platform.tenant.created_at.

ITD-022 Operational DDL Discipline, ITD-025 Platform Substrate Inheritance

None.

Example: 2026-05-20T12:30:00Z

Stable identifier assigned to one package ingest record.

Valid UUID and unique primary key.

Invalid when: Not a UUID or reused across package rows.

Platform package identity.

ITD-009 Package Resource And File Ingest

None.

Example: 7f2e4dd2-c147-49ea-af77-41a6fdd70980

Tenant that owns the package and all extracted resources.

Must reference platform.tenant(tenant_id). The route tenant, JWT tenant claim, package row, and all child rows must agree.

Invalid when: References a missing tenant or disagrees with the tenant path in the API request.

Tenant boundary inherited from Platform.

ITD-008 Tenant Boundary, ITD-009 Package Resource And File Ingest, ITD-025 Platform Substrate Inheritance

Belongs to exactly one platform.tenant; not nullable. The qti.tenant compatibility view may expose the same tenant_id for old queries.

Example: 0d4ce2f4-1c42-4f3c-9f0d-03fb7f5271d3

Original filename, URI, or content-addressable reference supplied by the ingest caller.

Nullable text. It is diagnostic only and must not be used as a trusted package locator after ingest.

Invalid when: Used as a primary identity, contains secrets, or points outside tenant authorization.

Operational ingest evidence.

ITD-009 Package Resource And File Ingest

None.

Example: publisher/grade-6-math/qti.zip

Package-specific copy of the customer-supplied Idempotency-Key, retained for explainable QTI package rows while replay ownership lives in platform.idempotency_key. listPackages exposes this value so a caller who lost the original ingest response can recover the key needed for same-key replay.

Unique with tenant_id when non-null. PostgreSQL allows multiple nulls for non-API repair/import rows; the public package-ingest API requires a non-empty Idempotency-Key and matching platform_idempotency_key_id. listPackages must return it as idempotencyKey when present.

Invalid when: Same tenant reuses the key for different package bytes, it differs from the referenced platform.idempotency_key.idempotency_key, the public API omits it on ingest, listPackages hides it when present, or a secret/token is stored here.

QTI package evidence for inherited platform idempotency behavior.

ITD-010 Idempotency And Hashes, ITD-018 API Boundary, ITD-025 Platform Substrate Inheritance, ITD-026 Tenant-Owned Enumeration And Lost-Response Recovery

Copies platform.idempotency_key.idempotency_key for package queries; the authoritative retry row is platform_idempotency_key_id.

Example: pkg-upload-2026-05-20-001

Reference to the shared Platform retry ledger row that claimed the package-ingest Idempotency-Key and can replay the original response when the caller persisted the key.

Must reference platform.idempotency_key(idempotency_key_id) for public package ingest. Nullable only for rollback-approved legacy, repair, or non-API import rows that predate the Platform ledger.

Invalid when: References a missing platform idempotency row, references another tenant/module/surface/operation, is null for public package ingest, or contradicts idempotency_key/request_hash.

Inherited Platform idempotency linkage required by QTI ITD-010 and ITD-025.

ITD-010 Idempotency And Hashes, ITD-018 API Boundary, ITD-025 Platform Substrate Inheritance, ITD-026 Tenant-Owned Enumeration And Lost-Response Recovery

Belongs to zero or one platform.idempotency_key row; for public API ingest it must be present and must have module=qti, surface=1edtech, method=POST, operation_id=ingestContentPackage, and the same tenant_id.

Example: b81db6f4-c7ea-4757-b5aa-87570f7ad119

Cryptographic hash of the normalized package payload used to identify repeated imports.

Required text and unique with tenant_id. Store the algorithm prefix with the digest, such as sha256:<hex>. listPackages returns it as packageHash so enumeration recovery can locate a package when the caller did not persist the Idempotency-Key.

Invalid when: Missing, not reproducible from the normalized package, or reused for different bytes in one tenant.

Idempotent persistence and audit.

ITD-010 Idempotency And Hashes, ITD-026 Tenant-Owned Enumeration And Lost-Response Recovery

None.

Example: sha256:6a8c1f58c16f4b0b4f0a0d8c6be8d226e3d5d80f0b2f7d2f49e6d7d9e9d4f1cb

IMS manifest identifier copied from imsmanifest when the package has one.

Nullable because loose XML ingest may not include imsmanifest. If present, preserve the source value without Alpha renaming.

Invalid when: Invented when no manifest exists, changed to a platform name, or used as a database primary key.

IMS content package manifest identifier.

ITD-009 Package Resource And File Ingest, ITD-007 Provenance Labels

None.

Example: MANIFEST-G6-MATH-2026

Conformance profile asserted for this import.

Required text. Current default and target profile is qti-3.0; optional feature sets must be explicit and supported by conformance evidence.

Invalid when: Unsupported profile string, null, or used to imply the live network spec changed the accepted bundle.

Platform conformance profile label tied to the offline QTI 3.0 bundle.

ITD-001 Offline 1EdTech Source Bundle, ITD-017 Conformance Evidence

None.

Example: qti-3.0

Current lifecycle state of package ingest.

Must satisfy content_package_import_status_ck. listPackages reports the value as importStatus; only imported rows are authoritative for current delivery and artifact recovery.

Invalid when: Outside the enum set or inconsistent with resource/artifact projection state.

Allowed values: Package import status

Platform package import lifecycle.

ITD-009 Package Resource And File Ingest, ITD-026 Tenant-Owned Enumeration And Lost-Response Recovery

None.

Example: imported

Generated package-level import evidence such as manifest facts, QTI metadata summaries, counts, validation diagnostics, and vocabulary projections.

Required JSON object. Do not store package bytes or secrets here; store original bytes in qti.package_file.

Invalid when: Null, non-object JSON, direct learner PII, access tokens, or duplicated source XML bytes.

Generated import evidence envelope.

ITD-009 Package Resource And File Ingest, ITD-020 Validation And Rejection Policy

None.

Example: {"resourceCount":18,"fileCount":42}

Timestamp when the package row was inserted and the timestamp component of the stable listPackages ordering.

Required timestamp with time zone. listPackages orders by imported_at then package_id and returns this value as importedAt.

Invalid when: Null or used as the source of content version ordering instead of artifact_version.version_number.

Import audit metadata.

ITD-022 Operational DDL Discipline, ITD-026 Tenant-Owned Enumeration And Lost-Response Recovery

None.

Example: 2026-05-20T13:00:00Z

Stable identifier for this manifest resource row.

Valid UUID and unique primary key.

Invalid when: Not a UUID or reused by another package_resource row.

Platform row identity.

ITD-009 Package Resource And File Ingest

None.

Example: aafcefe4-9814-4d43-93be-556dc38dace0

Owning content package.

Must reference qti.content_package(package_id). Cascades on package delete.

Invalid when: Missing package, cross-tenant package/resource mixture, or null.

Package ownership boundary.

ITD-009 Package Resource And File Ingest

Belongs to exactly one qti.content_package.

Example: 7f2e4dd2-c147-49ea-af77-41a6fdd70980

IMS manifest resource identifier copied from imsmanifest.

Required text and unique within the package. Preserve source spelling.

Invalid when: Duplicated within a package, rewritten to a platform UUID, or missing when the manifest resource has an identifier.

IMS manifest resource identifier.

ITD-009 Package Resource And File Ingest, ITD-007 Provenance Labels

None.

Example: item-RESPONSE-001

IMS/QTI resource type from the package manifest.

Required text. Values should match the package resource vocabulary or be explicitly preserved as extension.

Invalid when: Blank, invented by Alpha naming, or used to bypass validation.

Allowed values: IMS/QTI package resource type

IMS/QTI package resource type value.

ITD-009 Package Resource And File Ingest, ITD-007 Provenance Labels

None.

Example: imsqti_item_xmlv3p0

Package-relative path to the resource's primary file.

Nullable text. If present, must be normalized and must not escape the package root.

Invalid when: Absolute URL for a packaged file, path traversal, unnormalized slashes, or missing package_file for a required primary file.

IMS package resource href.

ITD-009 Package Resource And File Ingest, ITD-020 Validation And Rejection Policy

Usually corresponds to one qti.package_file.package_path.

Example: items/response-001.xml

Manifest dependency references and variant resource links generated from the package manifest.

Required JSON array. Each referenced resource identifier should resolve within the same package.

Invalid when: Null, non-array JSON, unresolved dependency, or cross-package dependency not represented as allowed external metadata.

IMS package resource dependency references.

ITD-009 Package Resource And File Ingest, ITD-020 Validation And Rejection Policy

References other qti.package_resource.resource_identifier values within the same package.

Example: ["stimulus-READING-PASSAGE-1"]

Manifest-derived metadata, file list, and resource facts generated at ingest.

Required JSON object. Keep generated manifest/resource evidence here; keep raw bytes in qti.package_file.

Invalid when: Null, non-object JSON, direct learner PII, auth tokens, or package bytes.

IMS manifest resource metadata projection when copied from manifest; generated file inventory remains gap-fill metadata.

ITD-009 Package Resource And File Ingest, ITD-007 Provenance Labels

None.

Example: {"files":["items/response-001.xml","media/chart.png"]}

Stable identifier for one original package file row.

Valid UUID and unique primary key.

Invalid when: Not a UUID or reused.

Platform file row identity.

ITD-009 Package Resource And File Ingest

None.

Example: 30225f0a-949d-49d5-a7fc-e2ea43863e96

Owning content package.

Must reference qti.content_package(package_id). Cascades on package delete.

Invalid when: References a missing package or mixes tenants.

Package ownership boundary.

ITD-009 Package Resource And File Ingest

Belongs to exactly one qti.content_package.

Example: 7f2e4dd2-c147-49ea-af77-41a6fdd70980

Manifest resource that first listed this file, when applicable.

Nullable. If present, must reference qti.package_resource(resource_id). Set null if the resource row is deleted.

Invalid when: References a resource from a different package or tenant.

Platform linkage from manifest resource to file preservation, including PCI interaction-module files.

ITD-009 Package Resource And File Ingest, ITD-030 Portable Custom Interaction Persistence And Execution Boundary

Belongs to zero or one qti.package_resource.

Example: aafcefe4-9814-4d43-93be-556dc38dace0

Normalized package-relative path for this file.

Required and unique inside package. Must not be absolute or contain traversal that escapes the package root.

Invalid when: Contains ../ escape, backslash ambiguity, an absolute scheme, duplicate normalized path, or a path not present in the uploaded package.

IMS package-relative file path.

ITD-009 Package Resource And File Ingest, ITD-020 Validation And Rejection Policy

None.

Example: items/response-001.xml

Detected or declared media type used for export, diagnostics, and content serving.

Required text. Use a valid media type string; default is application/octet-stream when unknown.

Invalid when: Null, unparseable as a media type, or trusted more than validation of the actual content.

Generated file metadata for platform serving and diagnostics.

ITD-009 Package Resource And File Ingest

None.

Example: application/xml

Original byte length of content_bytes.

Required integer. Must be zero or positive and equal to the stored bytea length.

Invalid when: Negative, null, or mismatched with content_bytes.

Generated package file evidence.

ITD-009 Package Resource And File Ingest

None.

Example: 18422

Cryptographic hash of the original file bytes.

Required text. Store algorithm prefix with digest; must be reproducible from content_bytes.

Invalid when: Missing, digest does not match content_bytes, or algorithm is not recorded.

File-level audit and export integrity evidence.

ITD-010 Idempotency And Hashes

None.

Example: sha256:92fb3e7a6e6d1df0e5759bda79b9c5a0459dfb7ccf2e0b9eb81227759df8c371

Original bytes exactly as accepted from the package for this path, including QTI XML, media, and Portable Custom Interaction JavaScript module files.

Required byte array. Must be preserved for faithful package export, audit, media delivery, and PCI client rendering. PCI JavaScript bytes may be returned to a delivery client, but the platform must not execute them server-side.

Invalid when: Null, replaced by parsed text only, mutated after ingest, contains a file that failed package-closure validation, or loaded into the server runtime as executable PCI code.

Original package file bytes.

ITD-009 Package Resource And File Ingest, ITD-004 XML Authority And Canonical Hashes, ITD-030 Portable Custom Interaction Persistence And Execution Boundary

None.

Example: <binary XML or media bytes>

Generated evidence about the file, such as manifest listing flags, validation role, and extracted diagnostics.

Required JSON object. Must not replace content_bytes.

Invalid when: Null, non-object JSON, auth tokens, direct learner PII, or raw file bytes duplicated as JSON.

Generated file-preservation evidence.

ITD-009 Package Resource And File Ingest, ITD-020 Validation And Rejection Policy

None.

Example: {"listedInManifest":true,"role":"primary-qti-xml"}

Timestamp when the file row was inserted.

Required timestamp with time zone.

Invalid when: Null or used as a proxy for QTI content versioning.

Package-file audit metadata.

ITD-022 Operational DDL Discipline

None.

Example: 2026-05-20T13:00:01Z

Stable platform identity for one logical artifact across versions.

Valid UUID and unique primary key.

Invalid when: Not a UUID, reused, or derived from a mutable QTI identifier.

Platform logical artifact identity.

ITD-011 Artifact Versioning

None.

Example: 58612cab-9c46-426c-8c20-0e9f19c807c5

Tenant that owns this artifact.

Must reference platform.tenant(tenant_id). It must match the owning package tenant when package_id is present.

Invalid when: Missing tenant or different from the owning package tenant.

Tenant ownership boundary inherited from Platform.

ITD-008 Tenant Boundary, ITD-011 Artifact Versioning, ITD-025 Platform Substrate Inheritance

Belongs to exactly one platform.tenant; old qti.tenant compatibility reads expose the same tenant_id only as a bridge.

Example: 0d4ce2f4-1c42-4f3c-9f0d-03fb7f5271d3

Origin package for imported artifacts.

Nullable for authored loose artifacts. If present, must reference qti.content_package(package_id). Set null if package is deleted.

Invalid when: References a package owned by another tenant.

Package origin evidence.

ITD-009 Package Resource And File Ingest, ITD-011 Artifact Versioning

Belongs to zero or one qti.content_package.

Example: 7f2e4dd2-c147-49ea-af77-41a6fdd70980

Origin manifest resource for imported artifacts.

Nullable for generated or loose artifacts. If present, must reference qti.package_resource(resource_id). Set null if resource is deleted.

Invalid when: Resource comes from another package or tenant.

Manifest origin evidence.

ITD-009 Package Resource And File Ingest, ITD-011 Artifact Versioning

Belongs to zero or one qti.package_resource.

Example: aafcefe4-9814-4d43-93be-556dc38dace0

Repository category derived from QTI root element or manifest resource type.

Must satisfy artifact_kind_ck.

Invalid when: Outside enum set, inconsistent with root_element on versions, changed for Alpha vocabulary, or used to create a QTI-owned Caliper event/result primitive.

Allowed values: Artifact kind

Gap-fill classification derived from QTI roots and package resources. ITD-032 pins result and usage-data as stock QTI document homes, not new platform result/statistics tables.

ITD-012 Artifact Kind Allowed Values, ITD-032 QTI Results Reporting And Caliper Boundary

None.

Example: item

QTI identifier attribute copied from the root object when present. listArtifacts returns it as qtiIdentifier so a caller can recover an artifact by source QTI identity after a lost ingest response.

Nullable because not every artifact has a root identifier. Preserve source spelling; do not use as a globally unique database key. If present, the raw recovery query must still filter by tenant_id.

Invalid when: Invented when absent, rewritten to a UUID, or assumed unique outside artifact scope.

QTI identifier attribute.

ITD-004 XML Authority And Canonical Hashes, ITD-007 Provenance Labels, ITD-026 Tenant-Owned Enumeration And Lost-Response Recovery

None.

Example: RESPONSE-001

QTI title or generated display label when present. listArtifacts returns it as title so a caller can recover and display an artifact without maintaining a client-side mirror.

Nullable. Preserve QTI title when present; generated labels must be distinguishable in metadata/spec trace. Title is a recovery aid, not a unique key.

Invalid when: Used as identity, translated without retaining source XML, or contains direct learner PII.

QTI title or package display metadata when copied from source.

ITD-004 XML Authority And Canonical Hashes, ITD-007 Provenance Labels, ITD-026 Tenant-Owned Enumeration And Lost-Response Recovery

None.

Example: Linear equations checkpoint

xml:lang or package-default language associated with the artifact.

Nullable BCP 47 language tag when known.

Invalid when: Not a language tag, invented without source/default evidence, or used to filter tenant access.

xml:lang or package default language.

ITD-004 XML Authority And Canonical Hashes

None.

Example: en-US

Newest immutable artifact version for convenience reads, including the latest authoring_json projection returned by getAuthoringJson and the latestArtifactVersionId returned by listArtifacts.

Nullable until a version exists. Must point to a qti.artifact_version for this same artifact when populated. Must agree with the highest version_number before an authoring-json read returns an ETag. listArtifacts may expose null only for a just-created artifact with no persisted version yet.

Invalid when: Points to another artifact's version, lags the highest version_number without repair evidence, listArtifacts surfaces a stale latestArtifactVersionId, or is treated as authoritative history instead of the artifact_version table.

Platform version lookup convenience.

ITD-011 Artifact Versioning, ITD-018 API Boundary, ITD-020 Validation And Rejection Policy, ITD-026 Tenant-Owned Enumeration And Lost-Response Recovery

Points to zero or one qti.artifact_version for the same artifact.

Example: efcf3561-3a66-4825-9588-e792ef20c312

Logical artifact creation timestamp and the timestamp component of the stable listArtifacts ordering.

Required timestamp with time zone. listArtifacts orders by created_at then artifact_id and returns this value as createdAt.

Invalid when: Null or used as version_number.

Artifact audit metadata.

ITD-022 Operational DDL Discipline, ITD-026 Tenant-Owned Enumeration And Lost-Response Recovery

None.

Example: 2026-05-20T13:00:02Z

Stable identifier for one immutable artifact edition.

Valid UUID and unique primary key.

Invalid when: Not a UUID or reused.

Platform version identity.

ITD-011 Artifact Versioning

None.

Example: efcf3561-3a66-4825-9588-e792ef20c312

Logical artifact this version belongs to; the join path that proves tenant ownership for listArtifactVersions and raw artifact-version reads.

Must reference qti.artifact(artifact_id). Cascades on artifact delete. Any tenant-scoped read must join qti.artifact and filter qti.artifact.tenant_id.

Invalid when: Missing artifact or cross-tenant mismatch through artifact.

Version belongs to logical artifact identity.

ITD-011 Artifact Versioning, ITD-026 Tenant-Owned Enumeration And Lost-Response Recovery, ITD-008 Tenant Boundary

Belongs to exactly one qti.artifact.

Example: 58612cab-9c46-426c-8c20-0e9f19c807c5

Forward-only per-artifact version number returned by listArtifactVersions as versionNumber.

Required integer and unique with artifact_id. Should increase by one for each saved edition.

Invalid when: Zero or negative by convention, duplicated for an artifact, skipped without migration evidence, or reused after rollback.

Immutable version sequencing.

ITD-011 Artifact Versioning, ITD-026 Tenant-Owned Enumeration And Lost-Response Recovery

None.

Example: 1

Original XML accepted after bundled XSD/Schematron validation.

Required PostgreSQL xml. Must validate before object creation and persistence.

Invalid when: Malformed XML, not valid against the bundled schema, contains direct learner runtime PII, or differs from the persisted object graph without trace.

Original QTI XML accepted from the 1EdTech source format.

ITD-004 XML Authority And Canonical Hashes, ITD-020 Validation And Rejection Policy

None.

Example: <qti-assessment-item identifier="RESPONSE-001" ...>

Canonicalized XML used for equivalence checks and stable export.

Required text. Must round-trip from object graph to XML and hash to xml_hash.

Invalid when: Not reproducible from object_graph, hash mismatch, or changed after delivery sessions point to this version.

Canonical QTI XML derived from source XML under platform canonicalization rules.

ITD-004 XML Authority And Canonical Hashes

None.

Example: <qti-assessment-item identifier="RESPONSE-001" ...>

Hash of canonical_xml used for idempotency and semantic preservation checks; returned by listArtifactVersions as xmlHash.

Required text and unique with artifact_id. Store algorithm prefix with digest.

Invalid when: Does not match canonical_xml, algorithm omitted, or duplicates a prior version for the same artifact.

Platform equivalence and idempotency evidence over QTI XML.

ITD-004 XML Authority And Canonical Hashes, ITD-010 Idempotency And Hashes, ITD-026 Tenant-Owned Enumeration And Lost-Response Recovery

None.

Example: sha256:e8a86d190e6d8865c4562b8e8b2b1e299f8a8d37a58c0bb71b35ef28bb62ab31

Root XML element for this version; returned by listArtifactVersions as rootElement.

Required text generated from bundled XSD root element catalog.

Invalid when: Not present in the bundled root catalog or inconsistent with source_xml.

QTI root element from bundled schemas.

ITD-004 XML Authority And Canonical Hashes, ITD-002 Generated Object Model Hub, ITD-026 Tenant-Owned Enumeration And Lost-Response Recovery

None.

Example: qti-assessment-item

Generated XSD type name for the root element.

Nullable for roots without generated type evidence; when present, must match bundled XSD generation.

Invalid when: Invented type, wrong schema namespace, or mismatch with root_element.

Generated XSD root type from bundled QTI schemas.

ITD-002 Generated Object Model Hub, ITD-004 XML Authority And Canonical Hashes

None.

Example: AssessmentItemDType

Bundled schema file used as validation authority.

Required text. Must name a schema in the offline QTI source bundle.

Invalid when: Live network schema URL, missing local schema, or schema that does not define the root.

Bundled QTI XSD file.

ITD-001 Offline 1EdTech Source Bundle, ITD-020 Validation And Rejection Policy

None.

Example: imsqti_itemv3p0p1_v1p0.xsd

Canonical generated object-model graph serialized as JSONB for internal persistence.

Required JSON object. Must preserve element order, attributes, text, tail text, identifiers, namespaces, types, and source trace enough to rebuild canonical XML.

Invalid when: Null, non-object JSON, loses mixed-content tail text, loses namespace identity, or becomes a public delivery contract.

Generated internal object graph for persistence; QTI defines XML, not this JSONB envelope.

ITD-002 Generated Object Model Hub, ITD-005 Lossless Relational Projection

None.

Example: {"element":"qti-assessment-item","identifier":"RESPONSE-001"}

Generated consumer-facing projection used by delivery applications and session snapshots.

Nullable before projection. May omit only declared authoring-only or diagnostic detail; must preserve identifiers needed for responses, feedback, scoring, accessibility matching, session replay, test-level navigation delegation, PCI client rendering, item-template presentation, and results/usage-data interchange where those documents are delivered.

Invalid when: Drops response identifiers, scoring dependencies, feedback links, accessibility references, test-navigation declarations, PCI markup/module references, template body references, or includes source traces not intended for delivery.

Generated delivery projection; QTI defines source XML, not this public JSON view. The projected QTI constructs remain stock pass-through values; runtime ownership is scoped by ITD-027 through ITD-032.

ITD-006 JSON Projection Boundaries, ITD-015 Delivery Session Snapshots, ITD-027 Server-Authoritative Timed Delivery And Time-Conditioned Outcome Processing, ITD-028 Test-Level Sequencing, Branching, And Adaptive Selection, ITD-029 Catalog And PNP Accessibility Activation, ITD-030 Portable Custom Interaction Persistence And Execution Boundary, ITD-031 Item Template Declaration, Processing, And Cloning, ITD-032 QTI Results Reporting And Caliper Boundary

None.

Example: {"kind":"test","identifier":"fluency-180","timeLimits":{"maxTime":180,"allowLateSubmission":false},"sections":[...]}

Generated authoring projection returned by GET /tenants/{tenantId}/qti/artifacts/{artifactId}/authoring-json for editors that must preserve all spec-defined fields.

Nullable before projection. Must round-trip to object_graph with no spec-defined field loss. When served by getAuthoringJson, it must come from the latest artifact_version for the known artifact_id and pair with an ETag derived from the immutable version/hash for the subsequent If-Match save.

Invalid when: Lossy, missing extension payloads, missing PCI/template/source trace needed for edits, built from delivery_json, stale relative to the selected latest version, or used for delivery without declared lossiness.

Generated authoring projection; QTI defines XML, not this editor JSON view. ITD-018 ships this operation-specific read because delivery_json may be declared-lossy.

ITD-006 JSON Projection Boundaries, ITD-011 Artifact Versioning, ITD-018 API Boundary, ITD-020 Validation And Rejection Policy, ITD-030 Portable Custom Interaction Persistence And Execution Boundary, ITD-031 Item Template Declaration, Processing, And Cloning

None.

Example: {"kind":"item","identifier":"RESPONSE-001","sourceTrace":{...}}

Generated traceability from classes, fields, and components to XSD/spec anchors.

Required JSON object. Must point back to the offline source bundle and generated model evidence.

Invalid when: Null, non-object JSON, live-only references, or links that cannot be reproduced from the bundle.

Generated traceability to bundled XSD/spec sources.

ITD-001 Offline 1EdTech Source Bundle, ITD-007 Provenance Labels

None.

Example: {"rootElement":"qti-assessment-item","schemaFile":"imsqti_itemv3p0p1_v1p0.xsd"}

Previous version replaced by this version, when the save was an edit or replacement.

Nullable. If present, must reference qti.artifact_version(artifact_version_id), normally for the same artifact.

Invalid when: Points forward in time, points to another artifact without explicit migration evidence, or creates a cycle.

Platform version history link.

ITD-011 Artifact Versioning

References zero or one earlier qti.artifact_version.

Example: a1f6b903-b26f-43ac-93ce-f6626ce3810d

Timestamp when this immutable version was created and the timestamp component of the stable listArtifactVersions ordering.

Required timestamp with time zone. listArtifactVersions orders by created_at then artifact_version_id and returns this value as createdAt.

Invalid when: Null or mutated to reorder version history.

Version audit metadata.

ITD-022 Operational DDL Discipline, ITD-026 Tenant-Owned Enumeration And Lost-Response Recovery

None.

Example: 2026-05-20T13:00:03Z

Principal or system actor that created the version.

Nullable text. Must be a safe principal label; do not store raw JWTs or secrets.

Invalid when: Raw access token, raw JWT subject that identifies a learner, email address, or other direct learner PII.

Platform audit metadata.

ITD-019 Security Boundary, ITD-024 Candidate And Learner Data Privacy

None.

Example: system:package-ingest

Stable identifier for one generated object node row.

Valid UUID and unique primary key.

Invalid when: Not a UUID or reused.

Platform row identity.

ITD-005 Lossless Relational Projection

None.

Example: c09956ea-d444-42b7-9e36-37f948a8c4f7

Artifact version containing this component.

Must reference qti.artifact_version(artifact_version_id). Cascades on version delete.

Invalid when: Missing version or cross-artifact projection.

Projection belongs to immutable version.

ITD-005 Lossless Relational Projection, ITD-011 Artifact Versioning

Belongs to exactly one qti.artifact_version.

Example: efcf3561-3a66-4825-9588-e792ef20c312

Parent object node, preserving the XML/object hierarchy.

Nullable for root node. If present, references qti.component(component_id) and cascades on parent delete.

Invalid when: Parent is in a different artifact_version, creates a cycle, or is missing for non-root nodes.

Relational hierarchy projection.

ITD-005 Lossless Relational Projection

References zero or one parent qti.component.

Example: null for the root component; c09956ea-d444-42b7-9e36-37f948a8c4f7 for a child node

Sibling order under parent_component_id.

Required integer. Use zero-based or one-based consistently in the repository; order must be stable for XML canonicalization.

Invalid when: Null, negative by repository convention, duplicated among siblings without deterministic tie-break, or changed after hashing.

Relational ordering needed for round trip.

ITD-005 Lossless Relational Projection, ITD-004 XML Authority And Canonical Hashes

None.

Example: 0

XML element name generated from the bundled XSD index, including feature-scope constructs such as qti-selection, qti-ordering, qti-branch-rule, qti-pre-condition, qti-adaptive-selection, qti-catalog-info, qti-portable-custom-interaction, qti-template-processing children, qti-printed-variable, assessmentResult, and usageData.

Required text. Must match the generated object node and source XML; deferring runtime navigation, PNP selection, PCI execution, or Caliper event emission does not permit dropping or renaming the source element.

Invalid when: Unknown to the generated model, mismatched with qualified_name, rewritten to an Alpha name, or omitted because the platform delegates that construct's runtime behavior.

QTI/XML element name from bundled XSD index.

ITD-002 Generated Object Model Hub, ITD-005 Lossless Relational Projection, ITD-028 Test-Level Sequencing, Branching, And Adaptive Selection, ITD-029 Catalog And PNP Accessibility Activation, ITD-030 Portable Custom Interaction Persistence And Execution Boundary, ITD-031 Item Template Declaration, Processing, And Cloning, ITD-032 QTI Results Reporting And Caliper Boundary

None.

Example: qti-portable-custom-interaction

Clark-notation qualified XML name used to preserve namespace identity.

Nullable for nodes without namespace evidence; when present, must combine namespace_uri and element_name correctly.

Invalid when: Namespace does not match namespace_uri, prefix-only value loses URI, or generated from live schema outside the bundle.

Qualified XML name preserving namespace identity.

ITD-004 XML Authority And Canonical Hashes, ITD-005 Lossless Relational Projection

None.

Example: {http://www.imsglobal.org/xsd/imsqtiasi_v3p0}qti-assessment-item

Namespace URI for this XML component, if any.

Nullable text. Must be the actual XML namespace URI, not an arbitrary prefix.

Invalid when: Prefix instead of URI, wrong QTI namespace, or discarded for namespaced elements.

Namespace URI from QTI/XML content.

ITD-004 XML Authority And Canonical Hashes

None.

Example: http://www.imsglobal.org/xsd/imsqtiasi_v3p0

Generated XSD type name for this object node.

Nullable. If present, must match generated type evidence from the bundled schema.

Invalid when: Invented type, type from the wrong namespace, or inconsistent with element_name.

Generated XSD type name.

ITD-002 Generated Object Model Hub, ITD-005 Lossless Relational Projection

None.

Example: AssessmentItemDType

QTI identifier attribute on this component when present.

Nullable. Preserve source value; identifier scope is QTI-defined and not always global.

Invalid when: Invented, coerced to UUID, or assumed globally unique across artifacts.

QTI identifier attribute.

ITD-004 XML Authority And Canonical Hashes, ITD-007 Provenance Labels

None.

Example: RESPONSE

Stable generated path from the root object to this component.

Required and unique within artifact_version_id. Must be reproducible from the generated object graph.

Invalid when: Not stable across rehydration, duplicated, or encodes tenant/private data.

Platform traceability and diff path.

ITD-005 Lossless Relational Projection

None.

Example: $.itemBody.choiceInteraction[0]

Raw generated attribute projection for fields not promoted to typed query tables, including navigation, CAT engine refs, catalog refs, PCI module refs, template rendering refs, and result/usage-data attributes.

Required JSON object. Must preserve QTI/XML attributes, including extension attributes, without changing names. qti-adaptive-selection refs, qti-catalog-info refs, qti-interaction-modules refs, and assessmentResult/usageData identifiers stay QTI-shaped.

Invalid when: Null, non-object JSON, drops data-* extension attributes, drops qti-adaptive-selection/qti-catalog-info/PCI/template/result attributes, or stores API auth headers.

Raw QTI/XML attributes not promoted to query columns.

ITD-004 XML Authority And Canonical Hashes, ITD-005 Lossless Relational Projection, ITD-028 Test-Level Sequencing, Branching, And Adaptive Selection, ITD-029 Catalog And PNP Accessibility Activation, ITD-030 Portable Custom Interaction Persistence And Execution Boundary, ITD-031 Item Template Declaration, Processing, And Cloning, ITD-032 QTI Results Reporting And Caliper Boundary

None.

Example: {"responseIdentifier":"RESPONSE","module":"urn:tb:pci:graphing"}

Text node value for text-bearing QTI and embedded content nodes.

Nullable text. Preserve source text needed for canonical XML round trip.

Invalid when: Dropped for mixed content, normalized in a way that changes semantics, or used to store learner responses.

Text node value from QTI or permitted embedded content.

ITD-004 XML Authority And Canonical Hashes, ITD-005 Lossless Relational Projection

None.

Example: Solve for x.

Tail text after this element, required for mixed-content XML round trips.

Nullable text. Must be preserved when XML mixed content uses tail text.

Invalid when: Dropped because it is inconvenient, moved into text_value incorrectly, or included in delivery_json without declared lossiness.

Mixed-content XML tail text needed for round trips.

ITD-004 XML Authority And Canonical Hashes, ITD-005 Lossless Relational Projection

None.

Example: after the interaction.

Generated trace to XSD and spec source for this component, including the ITD-pinned QTI feature construct that made this node important when applicable.

Required JSON object. Must be reproducible from the offline source bundle and generated model. For ITD-028 through ITD-032 constructs, include enough source evidence to prove the node was preserved rather than normalized away.

Invalid when: Null, non-object JSON, live-only link, not aligned with element_name/type_name, or missing evidence for a preserved navigation, PNP, PCI, template, result, or usage-data node.

Generated traceability to bundled XSD/spec sources.

ITD-001 Offline 1EdTech Source Bundle, ITD-007 Provenance Labels, ITD-028 Test-Level Sequencing, Branching, And Adaptive Selection, ITD-029 Catalog And PNP Accessibility Activation, ITD-030 Portable Custom Interaction Persistence And Execution Boundary, ITD-031 Item Template Declaration, Processing, And Cloning, ITD-032 QTI Results Reporting And Caliper Boundary

None.

Example: {"schemaFile":"imsqti_itemv3p0p1_v1p0.xsd","type":"PortableCustomInteractionDType"}

Stable row identifier for one promoted variable declaration.

Valid UUID and unique primary key.

Invalid when: Not a UUID or reused.

Platform projection row identity.

ITD-013 Variable Declaration Projection

None.

Example: 0c6f5271-9d9e-4df1-8d5d-2ad59dacde66

Artifact version that declares the variable.

Must reference qti.artifact_version(artifact_version_id). Cascades on version delete.

Invalid when: Missing version or mismatch with component_id artifact_version.

Variable projection belongs to immutable content version.

ITD-013 Variable Declaration Projection, ITD-011 Artifact Versioning

Belongs to exactly one qti.artifact_version.

Example: efcf3561-3a66-4825-9588-e792ef20c312

Component node that declared this variable.

Must reference qti.component(component_id). Cascades on component delete.

Invalid when: Component is not in the same artifact_version or is not a variable declaration node.

Projection link back to object graph component.

ITD-005 Lossless Relational Projection, ITD-013 Variable Declaration Projection

Belongs to exactly one qti.component.

Example: 7293a5f9-55a9-42cb-b8e6-a2be7d166d35

QTI variable category.

Must satisfy variable_kind_ck.

Invalid when: Outside enum set, used to invent a platform-only variable category, or fails to mark qti-template-declaration as template.

Allowed values: Variable declaration kind

QTI variable declaration category. ITD-031 makes qti-template-declaration queryable as variable_kind=template for server-side realization.

ITD-013 Variable Declaration Projection, ITD-007 Provenance Labels, ITD-031 Item Template Declaration, Processing, And Cloning

None.

Example: response

QTI variable identifier.

Required text. Unique with artifact_version_id and variable_kind.

Invalid when: Blank, duplicated within kind/version, rewritten to UUID, or mismatched with processing operands.

QTI variable identifier value.

ITD-013 Variable Declaration Projection, ITD-004 XML Authority And Canonical Hashes

None.

Example: RESPONSE

QTI cardinality for the variable value container.

Nullable only when the source declaration allows absence. When present, use QTI cardinality values such as single, multiple, ordered, or record.

Invalid when: Outside QTI cardinality vocabulary, inconsistent with associated interaction, or inconsistent with JSON value shape.

QTI cardinality value.

ITD-013 Variable Declaration Projection, ITD-021 Runtime Execution Profile

None.

Example: single

QTI base-type for atomic values when the declaration has one.

Nullable for record variables or declarations where QTI permits no base-type. Values should be QTI base types such as boolean, directedPair, duration, file, float, identifier, integer, pair, point, string, or uri.

Invalid when: Outside QTI base-type vocabulary, present for record in a way QTI forbids, or inconsistent with correct_response/default_value.

QTI base-type value.

ITD-013 Variable Declaration Projection, ITD-021 Runtime Execution Profile

None.

Example: identifier

Generated object value for qti-default-value.

Nullable. JSON shape must match cardinality and base_type.

Invalid when: Shape does not match cardinality/base_type, contains unvalidated extension payload, or is used as candidate response state.

Generated value for qti-default-value.

ITD-013 Variable Declaration Projection, ITD-004 XML Authority And Canonical Hashes

None.

Example: {"values":[0]}

Generated object value for qti-correct-response.

Nullable. JSON shape must match cardinality and base_type and preserve mapped identifiers exactly.

Invalid when: Correct response values are coerced, ordered values are stored as unordered, value type conflicts with base_type, or a templated correct response is realized by the client instead of the server.

Generated value for qti-correct-response. For templated items, server-side realization binds the effective correct response from template state before scoring.

ITD-013 Variable Declaration Projection, ITD-021 Runtime Execution Profile, ITD-031 Item Template Declaration, Processing, And Cloning

None.

Example: {"values":["choiceA"]}

Generated mapping, areaMapping, matchTable, or interpolationTable detail.

Nullable. Must preserve QTI mapping values, bounds, default scores, and interpolation details needed by processing.

Invalid when: Drops default mapping value, loses area coordinates, changes scoring numeric precision, or omits source trace.

Generated QTI mapping/detail payload.

ITD-013 Variable Declaration Projection, ITD-021 Runtime Execution Profile

None.

Example: {"defaultValue":0,"mapEntries":[{"mapKey":"choiceA","mappedValue":1}]}

Generated trace to XSD and spec section for the variable declaration.

Required JSON object and reproducible from the source bundle.

Invalid when: Null, non-object JSON, or not tied to the declaring component.

Generated trace to XSD and spec section.

ITD-001 Offline 1EdTech Source Bundle, ITD-007 Provenance Labels

None.

Example: {"element":"qti-response-declaration","schemaFile":"imsqti_itemv3p0p1_v1p0.xsd"}

Stable row identifier for one promoted processing rule or expression node.

Valid UUID and unique primary key.

Invalid when: Not a UUID or reused.

Platform projection row identity.

ITD-014 Processing Rule Projection

None.

Example: 74b1c279-e85f-407e-971e-16408ad792c0

Artifact version containing the processing rule.

Must reference qti.artifact_version(artifact_version_id). Cascades on version delete.

Invalid when: Missing version or mismatch with component_id artifact_version.

Processing projection belongs to immutable content version.

ITD-014 Processing Rule Projection, ITD-011 Artifact Versioning

Belongs to exactly one qti.artifact_version.

Example: efcf3561-3a66-4825-9588-e792ef20c312

Component node backing this processing rule.

Must reference qti.component(component_id). Cascades on component delete.

Invalid when: Component is not in the same artifact_version or is not a processing/expression node.

Projection link back to generated component.

ITD-005 Lossless Relational Projection, ITD-014 Processing Rule Projection

Belongs to exactly one qti.component.

Example: 913a57f5-98a5-4726-940b-d9610b721ccb

Parent processing rule for nested expression and rule trees.

Nullable for root rules. If present, references qti.processing_rule(processing_rule_id). Cascades on parent delete.

Invalid when: Parent is in another artifact_version, creates a cycle, or changes execution semantics.

Relational processing-tree hierarchy.

ITD-014 Processing Rule Projection

References zero or one parent qti.processing_rule.

Example: null for a root response-processing rule; 74b1c279-e85f-407e-971e-16408ad792c0 for a nested expression

Processing scope used for query and execution grouping.

Must satisfy processing_rule_scope_ck.

Invalid when: Outside enum set, used to claim QTI defines this SQL row scope, or stores qti-template-processing under response/outcome scope.

Allowed values: Processing rule scope

Repository classification for persisted processing rows. ITD-031 requires qti-template-processing to use template scope and be executed server-side at delivery-session start.

ITD-014 Processing Rule Projection, ITD-031 Item Template Declaration, Processing, And Cloning

None.

Example: response

QTI processing rule or expression element/operator name, including qti-set-template-value, qti-template-constraint, and qti-template-default for item-template realization.

Required text generated from the object graph and bundled XSD model.

Invalid when: Not a QTI processing/expression element, renamed for Alpha, mismatched with component.element_name, or drops template-processing rules because realization is server-side.

QTI processing rule or expression element name.

ITD-014 Processing Rule Projection, ITD-021 Runtime Execution Profile, ITD-031 Item Template Declaration, Processing, And Cloning

None.

Example: qti-map-response

Order within the parent processing scope.

Required integer. Must preserve QTI processing order and be stable across rehydration.

Invalid when: Null, order differs from object graph, or ties cause nondeterministic execution.

Execution ordering aid.

ITD-014 Processing Rule Projection, ITD-021 Runtime Execution Profile

None.

Example: 10

Generated operand references and literal values for execution.

Required JSON array. Must preserve variable references, literal values, and expression child references needed by the runtime.

Invalid when: Null, non-array JSON, points to undeclared variables, loses numeric precision, loses template-variable operands, or contains unredacted learner identity.

Generated QTI operand references and literal values, including template variable bindings used by qti-template-processing.

ITD-014 Processing Rule Projection, ITD-021 Runtime Execution Profile, ITD-031 Item Template Declaration, Processing, And Cloning

None.

Example: [{"variableIdentifier":"RESPONSE"}]

Generated trace to XSD and spec section for this processing rule.

Required JSON object and reproducible from the source bundle.

Invalid when: Null, non-object JSON, or not tied to the rule_name/component.

Generated trace to XSD and spec section.

ITD-001 Offline 1EdTech Source Bundle, ITD-007 Provenance Labels

None.

Example: {"element":"qti-map-response","schemaFile":"imsqti_responseprocessingv3p0_v1p0.xsd"}

Stable session identifier exposed by delivery APIs.

Valid UUID and unique primary key.

Invalid when: Not a UUID, reused, or guessable outside API authorization.

Platform delivery session identity.

ITD-015 Delivery Session Snapshots

None.

Example: e0b41369-3019-42a5-a419-d5da6e33904f

Tenant boundary for the delivery session.

Must reference platform.tenant(tenant_id). The tenant must match the route tenant, JWT tenant claim, and root artifact tenant.

Invalid when: Does not match authenticated tenant claim or root artifact tenant.

Tenant-scoped learner runtime boundary inherited from Platform.

ITD-008 Tenant Boundary, ITD-015 Delivery Session Snapshots, ITD-025 Platform Substrate Inheritance

Belongs to exactly one platform.tenant; old qti.tenant compatibility reads expose the same tenant_id only as a bridge.

Example: 0d4ce2f4-1c42-4f3c-9f0d-03fb7f5271d3

Opaque tenant-scoped pseudonymous UUID string for the candidate and the selector used by GET/DELETE /tenants/{tenantId}/qti/candidates/{candidateRef}/runtime-data.

Required text. Must be pseudonymous; direct names, emails, phone numbers, SIS IDs, raw JWT subjects, access tokens, and contact details are rejected. Must be indexed with tenant_id so getCandidateRuntimeData can read exactly one candidate's authorized runtime record without collection-wide browsing.

Invalid when: Contains direct learner or parent PII, raw JWT subject, auth token, SIS ID, or is not tenant-scoped.

Platform learner privacy boundary. QTI_CONTEXT candidateIdentifier uses this value only when runtime context needs it.

ITD-024 Candidate And Learner Data Privacy, ITD-019 Security Boundary

Indexed with tenant_id for candidate session history, candidate runtime-data read, and candidate runtime-data deletion.

Example: 9c41d14e-d011-4517-927e-b9bf0b7d5df4

Immutable item, test, or section version delivered in this session.

Must reference qti.artifact_version(artifact_version_id).

Invalid when: Missing version, version not owned by tenant, or changed after session start.

Session pins immutable content version.

ITD-015 Delivery Session Snapshots, ITD-011 Artifact Versioning

Belongs to exactly one qti.artifact_version.

Example: efcf3561-3a66-4825-9588-e792ef20c312

Session lifecycle state.

Must satisfy delivery_session_status_ck.

Invalid when: Outside enum set or inconsistent with attempts, submitted_at, or review workflow.

Allowed values: Delivery session status

Platform delivery lifecycle.

ITD-015 Delivery Session Snapshots

None.

Example: active

Snapshot of delivery_json at session start.

Required JSON object. Must remain stable for the session even if the artifact later receives a new version. When the pinned content declares qti-time-limits, the snapshot includes timeLimits.maxTime and timeLimits.minTime as QTI NonNegativeDouble seconds and timeLimits.allowLateSubmission as a boolean with the QTI default false.

Invalid when: Null, mismatched to root_artifact_version_id at start, mutated after attempts, contains authoring-only trace without declared lossiness, omits timeLimits for content that declared qti-time-limits, or treats client countdown state as authoritative timing.

Generated delivery projection snapshot for historical stability. The timeLimits values are pass-through QTI semantics; storing the snapshot is a platform gap fill.

ITD-006 JSON Projection Boundaries, ITD-015 Delivery Session Snapshots, ITD-027 Server-Authoritative Timed Delivery And Time-Conditioned Outcome Processing

None.

Example: {"kind":"test","identifier":"fluency-180","timeLimits":{"maxTime":180,"minTime":null,"allowLateSubmission":false}}

Runtime state not modeled as QTI variables, such as navigation, item sequencing, resume information, or review flags.

Required JSON object. Treat as learner-runtime data. Do not store direct PII, raw PNP records, tokens, IP addresses, or user agents.

Invalid when: Null, non-object JSON, auth headers, raw PNP records, direct learner identity, or state that contradicts delivery_json_snapshot.

Platform runtime state outside QTI variable declarations.

ITD-015 Delivery Session Snapshots, ITD-024 Candidate And Learner Data Privacy

None.

Example: {"navigation":"item","currentItem":"RESPONSE-001"}

Server timestamp at which the timed delivery window started for this session.

Nullable for untimed sessions. Required for a session whose delivered scope declares qti-time-limits with max-time. Must be recorded by the server clock, stored in UTC, and be less than or equal to window_expires_at when that field is present.

Invalid when: Client supplied, null for a max-time session, after window_expires_at, before created_at without migration evidence, or compared as local wall time.

Server-authoritative timing-window persistence for stock QTI qti-time-limits.

ITD-027 Server-Authoritative Timed Delivery And Time-Conditioned Outcome Processing, ITD-015 Delivery Session Snapshots

Used with qti.attempt.submitted_at to compute server-measured effective_duration_seconds and timing_status.

Example: 2026-05-20T13:15:00Z

Derived server timestamp at which the effective max-time window closes.

Nullable for untimed sessions and for a scope with no max-time. For max-time delivery it must equal window_started_at plus effective_max_time_seconds, with any allowed PNP extended-time adjustment already applied.

Invalid when: Present without window_started_at, earlier than window_started_at, inconsistent with effective_max_time_seconds, or manually extended after the session starts without documented PNP/administrative evidence.

Derived timing-window persistence authorized by ITD-027; QTI supplies max-time seconds, not a platform timestamp.

ITD-027 Server-Authoritative Timed Delivery And Time-Conditioned Outcome Processing, ITD-015 Delivery Session Snapshots

submitAttempt compares the server submission time against this timestamp to set qti.attempt.timing_status or return qti:time-limit-exceeded.

Example: 2026-05-20T13:18:00Z

Effective maximum time window in seconds after applying any QTI Personal Needs & Preferences extended-time accommodation.

Nullable for untimed sessions and for timed scopes without max-time. When present, must be a non-negative finite seconds value from QTI NonNegativeDouble semantics, and window_expires_at must be derived from it.

Invalid when: Negative, NaN, copied from a client request, differs from the timeLimits/PNP calculation without evidence, or non-null on an untimed session.

QTI defines max-time as seconds; the platform persists the effective value actually enforced for this session.

ITD-027 Server-Authoritative Timed Delivery And Time-Conditioned Outcome Processing, ITD-015 Delivery Session Snapshots

Derived from delivery_json_snapshot.timeLimits.maxTime plus authorized PNP extended-time policy; used by qti.attempt timing_status and the QTI duration built-in.

Example: 180

Session creation timestamp.

Required timestamp with time zone.

Invalid when: Null or later than updated_at.

Runtime audit metadata.

ITD-022 Operational DDL Discipline

None.

Example: 2026-05-20T13:15:00Z

Last session state mutation timestamp.

Required timestamp with time zone. Must be updated when status or session_state changes.

Invalid when: Null, earlier than created_at, or stale after status/session_state update.

Runtime audit metadata.

ITD-022 Operational DDL Discipline

None.

Example: 2026-05-20T13:16:10Z

Stable identifier for one attempt record.

Valid UUID and unique primary key.

Invalid when: Not a UUID or reused.

Platform attempt identity.

ITD-016 Attempt State And Processing Trace

None.

Example: 69e74a21-1190-492f-9f64-7557754d6eef

Owning delivery session.

Must reference qti.delivery_session(delivery_session_id). Cascades on session delete.

Invalid when: Missing session or tenant mismatch through session.

Attempt belongs to learner runtime session.

ITD-015 Delivery Session Snapshots, ITD-016 Attempt State And Processing Trace

Belongs to exactly one qti.delivery_session.

Example: e0b41369-3019-42a5-a419-d5da6e33904f

Immutable item/test artifact version attempted.

Must reference qti.artifact_version(artifact_version_id).

Invalid when: Does not belong to the delivery session snapshot or changes after processing.

Attempt pins content version for reproducible processing.

ITD-011 Artifact Versioning, ITD-016 Attempt State And Processing Trace

Belongs to exactly one qti.artifact_version.

Example: efcf3561-3a66-4825-9588-e792ef20c312

Attempt count within a session and artifact version.

Required integer and unique with delivery_session_id plus artifact_version_id. Should increase for repeated attempts.

Invalid when: Zero or negative by convention, duplicated, or reused after an adaptive attempt changes state.

Platform attempt sequencing.

ITD-016 Attempt State And Processing Trace

None.

Example: 1

Attempt lifecycle state.

Must satisfy attempt_status_ck.

Invalid when: Outside enum set or inconsistent with suspended_at/submitted_at.

Allowed values: Attempt status

Platform attempt lifecycle.

ITD-016 Attempt State And Processing Trace

None.

Example: submitted

Candidate response variables at the last processing point.

Required JSON object. Keys should be QTI response variable identifiers; values must match declaration cardinality/base_type. Treat as learner data.

Invalid when: Null, values inconsistent with qti.variable_declaration, unnecessary learner PII copied from outside the response, or logged without redaction.

QTI response variable state bound to learner runtime.

ITD-016 Attempt State And Processing Trace, ITD-024 Candidate And Learner Data Privacy

None.

Example: {"RESPONSE":"choiceA"}

Template variables used for item cloning and stability.

Required JSON object. Keys should be QTI template variable identifiers; values must match declarations.

Invalid when: Null, client-realized, regenerated on read instead of persisted, inconsistent with template processing trace, omitted for a templated item, or logged with learner identity.

QTI template variable state bound to session stability. ITD-031 requires the platform to realize qti-template-processing server-side before scoring.

ITD-016 Attempt State And Processing Trace, ITD-021 Runtime Execution Profile, ITD-024 Candidate And Learner Data Privacy, ITD-031 Item Template Declaration, Processing, And Cloning, ITD-032 QTI Results Reporting And Caliper Boundary

None.

Example: {"A":3,"B":5}

Outcome variables after template, response, and outcome processing, including declared time-conditioned outcomes when the test uses duration in outcome processing.

Required JSON object. Keys should be QTI outcome variable identifiers; values must match declarations and processing results. For timed delivery, the QTI duration value available to outcome processing is the server-measured effective duration, not a client-supplied value.

Invalid when: Null, cannot be reproduced by processing rules under the runtime profile, includes unsupported outcomes without diagnostics, returns only raw/max when the QTI declared richer outcomes, uses client-supplied timing to compute a time-conditioned outcome, or diverges from the assessmentResult projection.

QTI outcome variable state. ITD-027 requires declared QTI outcome processing server-side for timed tests; ITD-031 requires scoring against server-realized template values; ITD-032 uses these variables in the generated assessmentResult projection.

ITD-016 Attempt State And Processing Trace, ITD-021 Runtime Execution Profile, ITD-024 Candidate And Learner Data Privacy, ITD-027 Server-Authoritative Timed Delivery And Time-Conditioned Outcome Processing, ITD-031 Item Template Declaration, Processing, And Cloning, ITD-032 QTI Results Reporting And Caliper Boundary

None.

Example: {"SCORE":1,"MASTERY":true,"duration":172.4,"completionStatus":"completed"}

Deterministic trace of server-side template realization, response processing, outcome processing, assessmentResult projection evidence, and timed-enforcement operations.

Required JSON array. May include rule names, variable identifiers, before/after values, template-constraint retry/fail-closed diagnostics, timing-status decision evidence, and assessmentResult projection diagnostics. Must exclude JWTs, headers, access tokens, IP addresses, user agents, raw PNP records, raw package bytes, Caliper payloads, and direct learner identity fields.

Invalid when: Null, non-array JSON, nondeterministic, lacks failed-closed diagnostics for unsupported operators or template constraints, or contains auth/PII/Caliper data.

Implementation trace of QTI processing execution; QTI defines processing semantics, not this stored audit trail.

ITD-016 Attempt State And Processing Trace, ITD-021 Runtime Execution Profile, ITD-024 Candidate And Learner Data Privacy, ITD-027 Server-Authoritative Timed Delivery And Time-Conditioned Outcome Processing, ITD-031 Item Template Declaration, Processing, And Cloning, ITD-032 QTI Results Reporting And Caliper Boundary

None.

Example: [{"rule":"qti-outcome-processing","variable":"MASTERY","durationSource":"server"}]

Server-measured classification of this attempt against the owning delivery session's QTI time-limit window.

Must satisfy attempt_timing_status_ck. For an untimed session use untimed. For a timed session, in_window requires submitted_at to be within window_expires_at; late_accepted requires allowLateSubmission=true; late_rejected is retained only as rejected evidence when the API returned qti:time-limit-exceeded.

Invalid when: Outside enum set, computed from a client-supplied elapsed value, in_window after the server window expired, late_accepted when allowLateSubmission=false, or untimed while the session has an enforceable max-time.

Allowed values: Attempt timing status

Platform enforcement state over stock QTI qti-time-limits.

ITD-027 Server-Authoritative Timed Delivery And Time-Conditioned Outcome Processing, ITD-016 Attempt State And Processing Trace, ITD-020 Validation And Rejection Policy

Derived from qti.delivery_session.window_started_at/window_expires_at and server submit time; exposed in runtime/scoring responses for timed delivery.

Example: in_window

Server-measured QTI duration value in seconds for this attempt.

Nullable only when duration is genuinely unknown. When present, must be finite, non-negative, measured from server timestamps, and at least one-second resolution with 0.1 seconds or smaller preferred by the QTI guidance. Suspended time must be excluded when the attempt was suspended.

Invalid when: Negative, NaN, rounded from a client-submitted timer, includes suspended time, absent for a submitted timed attempt, or contradicts started_at/submitted_at/session-window evidence.

QTI defines duration as seconds; ITD-027 pins that the platform computes it from server timestamps and persists the effective value used by outcome processing.

ITD-027 Server-Authoritative Timed Delivery And Time-Conditioned Outcome Processing, ITD-016 Attempt State And Processing Trace, ITD-021 Runtime Execution Profile

Fed into QTI duration built-in during outcome processing and compared with delivery_session.effective_max_time_seconds for timing_status.

Example: 172.4

Attempt start timestamp.

Required timestamp with time zone.

Invalid when: Null or after submitted_at.

Runtime audit metadata.

ITD-022 Operational DDL Discipline

None.

Example: 2026-05-20T13:16:20Z

Attempt suspension timestamp, if the attempt was suspended.

Nullable timestamp with time zone. Should be set when status is suspended.

Invalid when: Set while status never suspended without lifecycle evidence, before started_at, or after submitted_at.

Runtime lifecycle audit metadata.

ITD-016 Attempt State And Processing Trace

None.

Example: 2026-05-20T13:17:00Z

Attempt submission timestamp, if the attempt was submitted.

Nullable timestamp with time zone. Should be set when status is submitted or reviewed.

Invalid when: Before started_at, set while status remains active without evidence, or absent for submitted/reviewed attempts.

Runtime lifecycle audit metadata.

ITD-016 Attempt State And Processing Trace

None.

Example: 2026-05-20T13:18:02Z

Stable identifier for one conformance run.

Valid UUID and unique primary key.

Invalid when: Not a UUID or reused.

Platform evidence row identity.

ITD-017 Conformance Evidence

None.

Example: ed0065af-721c-4799-a48c-8ce0c5fdc7f2

Targeted QTI 3.0 conformance profile or optional feature set.

Required text. Must be a profile the runner understands.

Invalid when: Unsupported profile, Alpha-only label, or profile not represented by assertions.

Platform conformance profile label tied to the QTI bundle.

ITD-017 Conformance Evidence, ITD-001 Offline 1EdTech Source Bundle

None.

Example: qti-3.0

Hash of the offline spec bundle used by the run.

Required text with algorithm prefix and digest.

Invalid when: Missing, live network URL, or not reproducible from the bundle used.

Release evidence ties to immutable local source bundle.

ITD-001 Offline 1EdTech Source Bundle, ITD-017 Conformance Evidence

None.

Example: sha256:184e568a31e239c0b282e7e1926dd7e8756901826f4a91e9e5b1ad58369d9ef4

Version or identity of the conformance runner.

Required text. Must be specific enough to reproduce behavior.

Invalid when: Blank, vague, or points to unpinned code.

Release evidence metadata.

ITD-017 Conformance Evidence

None.

Example: qti-conformance-runner/2026-05-20

Run start timestamp.

Required timestamp with time zone.

Invalid when: Null or after finished_at.

Conformance audit metadata.

ITD-022 Operational DDL Discipline

None.

Example: 2026-05-20T14:00:00Z

Run finish timestamp, if complete.

Nullable timestamp with time zone. Should be set for passed, failed, or error.

Invalid when: Before started_at, absent for completed terminal status without explanation, or set while still running.

Conformance lifecycle audit metadata.

ITD-017 Conformance Evidence

None.

Example: 2026-05-20T14:04:30Z

Run lifecycle status.

Must satisfy conformance_run_status_ck.

Invalid when: Outside enum set or inconsistent with child assertion statuses.

Allowed values: Conformance run status

Release evidence lifecycle.

ITD-017 Conformance Evidence

None.

Example: passed

Generated coverage and pass/fail summary.

Required JSON object. Should include counts, profile facts, and links/keys to assertion evidence; must not include secrets or learner-runtime data.

Invalid when: Null, non-object JSON, contradicts assertion rows, or includes raw package bytes/secrets.

Generated release-gate summary.

ITD-017 Conformance Evidence

None.

Example: {"examples":327,"assertions":28292,"failed":0}

Stable identifier for one assertion result.

Valid UUID and unique primary key.

Invalid when: Not a UUID or reused.

Platform assertion row identity.

ITD-017 Conformance Evidence

None.

Example: 40bdfcf0-b97b-4a38-b308-a5d271a75943

Owning conformance run.

Must reference qti.conformance_run(conformance_run_id). Cascades on run delete.

Invalid when: Missing parent run or status contradicts parent run summary.

Assertion belongs to release evidence run.

ITD-017 Conformance Evidence

Belongs to exactly one qti.conformance_run.

Example: ed0065af-721c-4799-a48c-8ce0c5fdc7f2

Stable key generated by the conformance runner for this assertion.

Required text and unique within the run. Must be deterministic for the same assertion.

Invalid when: Duplicated in a run, nondeterministic across reruns, or so vague it cannot locate the assertion.

Generated assertion identity.

ITD-017 Conformance Evidence

None.

Example: roundtrip:items/response-001.xml

Example, fixture, or artifact path covered by this assertion.

Nullable when assertion is feature-level only. If present, should point to a bundled example, generated artifact, or artifact identifier.

Invalid when: Live-only URL, missing fixture, or reference to learner-runtime data.

QTI example or artifact reference covered by conformance evidence.

ITD-001 Offline 1EdTech Source Bundle, ITD-017 Conformance Evidence

None.

Example: examples/qtiv3-examples/items/response-001.xml

Spec section, schema component, or generated trace reference covered by this assertion.

Nullable when the assertion is implementation-only. If present, must be reproducible from the bundled source or generated traceability.

Invalid when: Points only to live network docs, wrong schema file, or cannot be followed by a future generator.

1EdTech spec, schema, or generated traceability reference.

ITD-001 Offline 1EdTech Source Bundle, ITD-007 Provenance Labels, ITD-017 Conformance Evidence

None.

Example: imsqti_itemv3p0p1_v1p0.xsd#qti-assessment-item

Assertion result status.

Must satisfy conformance_assertion_status_ck.

Invalid when: Outside enum set, contradicts details, or failed/error without diagnostics.

Allowed values: Conformance assertion status

Generated assertion result lifecycle.

ITD-017 Conformance Evidence

None.

Example: passed

Assertion diagnostics, canonical hashes, processing outcomes, and failure details.

Required JSON object. Failed or error assertions must explain enough for reproduction. Must not include secrets, raw JWTs, direct learner PII, or unrelated package bytes.

Invalid when: Null, non-object JSON, missing diagnostics for failure, or contains auth/PII data.

Generated release-gate diagnostics; QTI defines conformance expectations, not this evidence payload.

ITD-017 Conformance Evidence, ITD-024 Candidate And Learner Data Privacy

None.

Example: {"canonicalHashMatched":true}