# Keplo ↔ LMS Integration Strategy

> *Living strategy document. Strengthens as we gather real-cohort
> evidence. Each decision-locking event adds an entry to §10
> "Strategy evolution log" with the evidence that shaped it.*
>
> **Owner:** Ben Booth (product lead, Keplo)
> **Co-lead:** Ondrej Chvala (pedagogy + curriculum)
> **Scope:** Multi-LMS integration architecture. **Canvas is the
> first concrete adapter** (UT Sp26 cohort proving ground); Moodle /
> Blackboard / Brightspace / Google Classroom are planned future
> adapters via the same abstraction layer.
> **Bidirectional-sync principle:** Strategy doc ↔ PRD ↔ lead paper
> ↔ code stay aligned as evidence accumulates. AND: LMS↔Keplo
> integration is bidirectional by design (read materials in; write
> proposals back) — not one-way pull.

## 1. Why this matters

Modern LMSes (Canvas, Moodle, Blackboard, Brightspace, Google
Classroom, Schoology, Microsoft Education, Sakai, etc.) are the
incumbent surfaces for instructors and students. Keplo can't
credibly serve any cohort if it ignores the LMS; it has to *coexist
with* the LMS, *complement* in-LMS AI tooling (e.g., Canvas's
IgniteAI Search), and *integrate cleanly into* the instructor's
existing workflow.

**Strategic position (sharpened 2026-04-30):**

The LMS *category* — across all major vendors — converges on the
same primitives (course identity, roster, gradebook, files,
announcements, assignments, modules, calendar, LTI integration) and
shares the same *structural gaps* (no grounded AI native; no
per-student capability composition; no federation-native curriculum;
no instructor productivity layer; tool proliferation rather than
curated UX). Keplo's positioning isn't "Canvas AI add-on" — it's a
**federation-native sovereign AI layer that operates above any LMS,
addressing what the entire LMS category structurally fails to
deliver.** Each LMS provides the system-of-record substrate; Keplo
provides the AI + federation + per-student-composition layer above.

**Empirical position from real Sp26 cohort observation (2026-04-30):**
- Real cohort substance lives largely in Canvas — files (textbooks
  including the 161-page VR-1 textbook by Jan Frýbort 2014),
  assignments (8 quizzes + multiple labs + extra credit shells),
  announcements (academic + logistical + intellectual-breadth tiers),
  pages, syllabus, modules, discussions, IAEA-themed material
- Canvas already has AI tooling (IgniteAI Search) — empirically
  characterized as pure search with re-rank, no LLM generation, no
  file indexing, no refusal-quality on integrity-adjacent probes.
  Confirmed across 4 query types (2026-04-30 cohort metadata).
  Sets baseline AI literacy expectations for UT students.
- UT-side existing tools: ~30 distinct course surfaces (left nav)
  including My Classroom, NameCoach, RegisterBlast, Ally, UT Simple
  Syllabus, My Textbooks, Panopto Video, Gradescope, Zoom — Keplo
  positioned *not* as one of these but as the unified layer above

## 2. Strategic principles

1. **Don't be Canvas Tool #31** (or Moodle Block #21, or Blackboard
   Building Block #N+1). Each LMS already has ~20-30 narrow per-course
   tools with their own UI, mental model, permission matrix. Adding
   one more loses in the attention contest. Keplo's differentiator is
   architectural — *one surface, three contexts* (author / deliver /
   monitor for instructor; ask / practice / reflect for student)
   backed by a coherent RAG + federation + audit foundation. LMS
   tools become substrates Keplo reads/writes; not surfaces the user
   manages directly. *The simplification IS the product.* (See
   `feedback_keplo_one_surface_three_contexts`.)
2. **The LMS remains source of record.** Materials authored in the
   LMS; Keplo *mirrors* (with consent) for sovereign processing.
   Write-back is opt-in instructor convenience, never automatic.
3. **Sovereign processing.** Synced material lives on the
   institutional Keplo node (Rascal); not in commercial AI cloud.
4. **Multi-tier RAG architecture (NOT one RAG store).** Per Ondrej's
   design + ADR-019 node profiles, the RAG architecture spans:
   - **Student-local** (Axiom Edge node, sovereign per-student) —
     personal memory + accumulated learning history + a from-zero
     private RAG seeded at enrollment with Ondrej's curated
     classroom materials
   - **Cohort/classroom** — curated classroom corpus (replicated to
     each student node from coordinator on join)
   - **Federated/Rascal** (Server tier) — institutional broader corpus
     accessed silently by Keplo when local is insufficient (student
     doesn't see "fetching from Rascal," they get a richer answer)
   - **Peer pulls** (opt-in cross-student) — classmates' shared content;
     Ondrej's design — stretch goal for v0
   Keplo's routing layer decides local-first → federation → peer-pulls
   per query, with single coherent identity / audit / composition
   primitives across all tiers. *The "one" claim is one product, not
   one store.*
5. **Coexistence, not replacement.** LMS + in-LMS AI tooling + Keplo
   address different needs:
   - LMS = course-of-record (assignments, gradebook, roster, calendar)
   - In-LMS AI (e.g., Canvas IgniteAI Search) = "find content" in LMS
   - **Keplo = "understand and author content"** (RAG-grounded tutor
     for students + RAG-grounded co-pilot for instructors; same
     federated foundation + per-student composition)
6. **Sync, not lock-in.** Instructor can stop using Keplo and the
   LMS continues unaffected.
7. **FERPA-aligned by construction.** No student data egress to
   commercial AI cloud. Sovereign per-institution audit trail
   (LangFuse on each Server-tier node).
8. **Bidirectional sync, not one-way pull.** LMS → Keplo (read
   materials, roster, announcements, files) AND Keplo → LMS (write
   instructor-approved proposals: drafted assignment content,
   refreshed announcements, refreshed dates from Capability C
   migrations, suggested rubrics tied to outcomes). Always
   instructor-approval-gated; never auto-publish. Living sync, not
   one-shot import.

## 2.5 The three-bucket integration framework

For every LMS-side surface, Keplo applies one of three patterns:

### A. Copy (table stakes — Keplo reads/coexists)

Cross-LMS table stakes — every modern LMS converges on these
primitives; Keplo must read them but doesn't innovate here:

| Surface | Why Keplo reads it | Read priority |
|---|---|---|
| **Files / Resources** (PDFs, slides, lab manuals, textbooks) | High-value content the LMS-native AI search typically can't index | 🔴 Highest |
| **Announcements** | Stream of academic + logistical content (multi-tier per H7) | 🔴 High |
| **Assignments + due dates** | Defines scope + time pressure for grounding | 🔴 High |
| **Syllabus** | Course-objectives, schedule, late policy | 🔴 High |
| **Outcomes / mastery framework** | Pedagogical-goals layer; KPI claims depend on it | 🟡 Medium |
| **Roster (with consent)** | Per-student personalization; FERPA surface applied | 🟡 Medium |
| **Modules** | Week-by-week structural scaffold | 🟡 Medium |
| **Discussions** | Sometimes academic content; tier-classify with H7 logic | 🟢 Phase 0.2 |
| **Pages** | Native LMS content pages (rich-text instructor authored) | 🟢 Phase 0.2 |
| **Course identity** (numeric ID, code, term, section) | Federation Class identity binding (per ADR-034) | 🔴 Required |

### B. Avoid (LMS does well — integrate but don't replicate)

The LMS category excels at being the institutional course-of-record
+ integration hub. Keplo respects that; doesn't try to replace.

| LMS-strength | Why Keplo doesn't replicate |
|---|---|
| **Course-of-record gradebook** | 20+ years of policy / legal / compliance scaffolding. Replacing is unwise. Keplo writes grade *proposals* back; gradebook stays in LMS. |
| **Institutional plumbing** (SIS / SSO / billing / accreditation) | Bank-grade infra; unique per institution; not Keplo's value-add |
| **Cross-course aggregation** (calendar, inbox across all courses) | LMS owns the *whole* term, not just one course |
| **Long-tail third-party LTI ecosystem** (Gradescope, NameCoach, Panopto, Zoom, Turnitin, Microsoft Education) | Each is a deep specialty; LMS's value is being the hub |
| **Familiar UX consistency** (instructor doesn't relearn per course) | Hard-won familiarity; surface through it, not around it |
| **Synchronous + asynchronous communication infrastructure** (notifications, inbox, forum threading) | Mature, reliable; integrate, don't replace |
| **Compliance / accessibility tooling** (Ally / WCAG specialists) | Specialized communities + standards |
| **Standard interop** (LTI 1.3 / SCORM / Common Cartridge / xAPI) | Industry consensus we benefit from existing |
| **Course-of-record permission matrix** | 20-year-old institutional-policy-shaped role definitions |

### C. Go deep (Keplo's architectural differentiation)

The unifying frame: **one Keplo product, three contexts, all the
same RAG + federation + audit foundation.** Not separate features.

| Surface | What Keplo provides that LMS-category categorically can't |
|---|---|
| **Grounded student tutor** (ask/practice/reflect/review) | RAG-grounded answers over Files (which IgniteAI / Moodle search / Blackboard search can't see), with provenance citations to specific source passages, with per-student RAG-mode + LLM-tier composition. *Refusal-quality dimension empirically demonstrated.* |
| **Instructor co-pilot** (author/deliver/monitor) | Capabilities A+B+C: course-shell bootstrap, content auto-fill for empty shells, course-version migration with provenance. Productivity claim is *order of magnitude* time saved with traceable provenance. |
| **Per-student composition** | Instructor sets cohort default + per-student overrides for RAG mode AND LLM tier. Maps learning modes (quiz/tutor/reflect/research) to capability tiers (dumb/standard/smart/smartest). LMS category has zero analog. |
| **Federation-native curriculum** | Course = canonical, citable, forkable, version-tagged artifact (ADR-034). Multi-institution misconception aggregation, federated KPI baselines, peer-Course inheritance. LMS-locked institutions can't do this. |
| **Sovereign, grounded refusal-quality** | Explained refusals with provenance vs LMS-native silent "no results." Pedagogically the most important under-evaluated dimension. |
| **Multi-tier RAG routing** | Local (student-Edge) → cohort-shared → federation (Rascal) → peer pulls; coherent identity + audit + composition across tiers (per §2 principle 4) |
| **Bidirectional instructor↔student threads with evidence trail** | Tier C — already shipped |

## 3. Concrete UT-Canvas surface (captured 2026-04-30)

### Identifiers
- Canvas instance: `utexas.instructure.com`
- Course numeric ID for Sp26 M E 336P / Prague: `1442954`
- Canvas API base: `https://utexas.instructure.com/api/v1/courses/1442954/`
- Course code: `Sp26 - CNCPTS NUC/RADIATN ENGR-CZE (19534)`
- Section: `19534`, suffix `CZE`
- UT short code: `M E 336P`

### Surfaces visible in left nav
Home / IgniteAI Search / Announcements / Assignments / Discussions /
People / Pages / Files / Syllabus / Outcomes / Rubrics / Quizzes /
Modules / Collaborations / Research Help / Attendance / Item Banks /
Zoom / My Classroom / RegisterBlast / Course Evaluations / Ally
Course Accessibility Report / NameCoach / UT Canvas Apps / UT Simple
Syllabus / My Textbooks / Panopto Video / Gradescope / Microsoft
Education / Settings

### Content types observed in the actual Sp26 course
- **8 quizzes** (Quiz 1 - Quiz 8) — Assignment-tagged
- **4+ labs** (Lab 5, 6, 7, 8 visible; Labs 1-4 likely exist) —
  Assignment-tagged
- **Extra credit** — Assignment
- **Files area populated** — at least: ENR 1 textbook 2010
  (file ID 79064157), additional PDFs (file ID 79023634)
- **Multiple announcement tiers**:
  - Academic / professional: NPT treaty reading, Hashimoto
    explosion-map educational, IAEA opportunities, Bertrand Russell
    *History of Western Philosophy* recommendation
  - Logistical / travel: restaurant recs from former-student Tyrone
    Harris (now at IAEA), side trips (Kutna Hora, Karlovy Vary),
    Prague navigation, Map of Czech Republic, crystal store, Czech
    garnet jewelry
  - Cultural / intellectual breadth: Czech-culture short book
- **Welcome / orientation announcement** — "Welcome to study abroad
  class!" — confirms it's a study-abroad program with real travel
- **Czech language prep** — FSI program referenced

## 4. Integration surface plan

### Folder-by-folder Files ingestion policy (added 2026-04-30 after Files area observation)

Real M E 336P / 1442954 Files area observation revealed substantial
folder-organized content. Default Keplo ingestion policy:

| Canvas folder | Likely content | Phase 0.1 default | Reasoning |
|---|---|---|---|
| **Lectures** | Slide decks, lecture transcripts, notes | ✅ Ingest | H4 gating evidence; STEM lecture material stress-tests chunker |
| **Textbooks** | PDF textbooks (ENR 1 textbook 2010 + others) | ✅ Ingest | Book-length PDFs are V1-vs-V2-vs-V3 chunker proving ground; high student value |
| **Templates** | Assignment / lab-report templates | ☑ Optional | Useful for Capability B (content auto-fill) reference material |
| **Course Image** | Banner / icon | ❌ Skip | No academic content |
| **Photos** | Likely student photos / Prague-trip images | ❌ **Skip by default — PII / consent risk** | Students likely in images; opt-in only after consent UX is built (PRD §11 G2 dependency) |
| **Videos** | Recorded lectures / Panopto exports | ⏸ Defer to Phase 1.0+ | Separate Panopto integration; transcripts may be auto-generated upstream; large bandwidth cost |
| *(other folders not yet observed)* | TBD | Default = require explicit instructor opt-in | Conservative default; instructor approves per-folder for ingestion |

Phase 0.1 default behavior: instructor sees folder list at `prep lms`
time; explicit per-folder approval for ingestion. Lectures + Textbooks
suggested as defaults; Photos auto-excluded with consent-UX warning.

### Phase 0.1 — minimum viable (target: 2026-05-15, Phase 0.1 deadline)

| Capability | Status |
|---|---|
| Canvas course identity binding (`axi classroom prep lms --canvas-course 1442954`) | Designed; today only `--fake` flag works. **Build before Prague.** |
| Read-only Canvas API auth (instructor-issued token, OAuth deferred) | Not built. **Build for Phase 0.1.** |
| Files sync (PDF / docx / pptx → Keplo coordinator materials store) | **Highest-value gap from real-cohort observation.** Build for Phase 0.1. |
| Announcements sync with tier classification | Build; tier classifier post-MVP, default everything to course-corpus initially |
| Assignments sync (read-only — Keplo doesn't author assignments) | Build for Phase 0.1; index titles + descriptions for retrieval scoping |
| Sync mode: instructor-triggered pull | Build for Phase 0.1; webhook-driven sync deferred |
| Federation Class identity bound to Canvas course ID + section | Per ADR-034; document the binding pattern |

### Phase 0.1 expansion — instructor co-pilot capabilities (added 2026-04-30 after Sp26 cohort observation)

Direct observation of Ondrej's M E 336P / Sp26 course revealed
that the published assignment shells (Lab 1-8, Quiz 1-8, Extra
Credit) are **structural only** — created via Canvas but with no
actual content inside. This surfaces a **second-order Keplo
capability** that's higher-leverage than student-tutoring alone:

#### Capability A — Course-shell bootstrap (`axi classroom propose-structure`)
- **Input:** course materials (syllabus, textbook, learning objectives, instructor profile, prior cohort versions, federation peer-Course examples)
- **Output:** proposed assignment skeleton with a typical structure for this kind of course (N labs / N quizzes / midterm / final / extra credit) — instructor reviews, edits, approves before publication to Canvas
- **Audience:** instructor with empty course shell (or new course design)

#### Capability B — Content auto-fill (`axi classroom propose-content`)
- **Input:** existing assignment shells + course materials + week-by-week curriculum + textbook + lab manuals + announcements
- **Output:** proposed draft content for each shell (lab procedure, expected observations, grading rubric / quiz questions / midterm topics) — instructor reviews, edits, approves before publication
- **Audience:** instructor with structured-but-empty course (Ondrej's current state)

#### Capability C — Course-version migration (`axi classroom course fork ... --term sp26-prague`)
- **Input:** prior-version Course (e.g., a NEUET 2025 syllabus PDF observed in Sp26 Files area, suggesting Ondrej is porting an older offering) + new term context + new institution context + new academic-calendar schedule
- **Output:** proposals for what to *update* (dates, references, term-specific announcements, schedule realignment, institution-specific conventions) — leaving the academic substance intact
- **Audience:** instructor adapting a prior course offering to a new cohort
- **Maps to ADR-034's federation Course-fork pattern.** The architectural abstraction (`axi classroom course fork --from axiom://course/utk-ne/neuet/v1.0.0 --to axiom://course/utexas-ne/concepts-of-nuclear-radiation-engineering/v1.0.0 --term sp26-prague`) IS the workflow Ondrej is doing manually right now.

#### Productivity-claim quantification (the core paper §1 hook)

Manual instructor pipeline for course-version migration:
- Reread prior syllabus → identify outdated content
- Refresh 8 labs + 8 quizzes for current materials
- Rebuild week-by-week schedule against new academic calendar
- Refresh cohort-specific announcements
- Update problem set due dates
- Reconcile institution-specific differences

Estimate: **many tens of hours** of instructor work.

With Keplo Capabilities B + C:
- Pull prior Course + new schedule context
- Propose updated content / dates / adjustments with citations
- Instructor reviews each proposal (cite-everything pattern)
- Approve / edit / publish to Canvas

Estimate: **a few hours** of instructor review, with traceable provenance.

**The time-saving order of magnitude is the paper's productivity differentiator** — not "AI in your classroom" (already exists), not "RAG-grounded answers" (incremental); but **"your prior course migrates to your new cohort in hours instead of weeks, with provenance for every change."**

#### Why this matters more than student-tutoring alone

- **Same RAG foundation, two-sided value:**
  - **Student side:** "understand course content" (grounded answers with citations)
  - **Instructor side:** "author course content" (grounded proposals with citations to source materials)
- **Pivots Keplo's value proposition** from "another AI tutor" (which UT students already have via IgniteAI Search and external commercial tools) to **instructor productivity tool that also serves students** (which UT instructors do *not* have)
- **Paper #4 framing alignment:** "The Tutor That Shows Its Work" — Keplo shows its work both for student answers AND for instructor content proposals; the provenance + citation pattern is identical
- **Pedagogical safeguard:** instructor reviews every proposal; Keplo never auto-publishes; like CHALKE, the instructor remains final decision-maker (PRD §8 mitigation preserved)

#### Implementation path

| Phase | Increment |
|---|---|
| Phase 0.1 | Capability B (content auto-fill for existing shells) — instructor in the loop, draft → review → approve → publish-to-Canvas |
| Phase 0.2 | Capability A (course-shell bootstrap from empty state) — riskier; proposing structure is a more architectural decision |
| Phase 1.0 | Federation peer-Course suggestion ("OSU NE-101 has this lab structure; want to fork?"); cross-cohort improvement (CHALKE observes weak student understanding → proposes assignment refinement to instructor) |

#### Risks specific to this capability

| Risk | Mitigation |
|---|---|
| **Instructor abdication** (rubber-stamp without review) | UI emphasizes "draft pending instructor approval" framing; LangFuse logs every proposal-to-approval cycle for audit |
| **Drift from Ondrej's voice** | Proposal includes the source materials it drew from; instructor edits in their own voice before approval |
| **Federation pollution** (a poorly-reviewed proposal becomes a peer-Course example) | Proposals don't auto-promote to federation Course Registry; explicit publish-to-federation step with versioning per ADR-034 |
| **Academic-integrity perception** (student sees "AI wrote my quiz") | Disclosure: when instructor publishes Keplo-drafted content, Canvas-side metadata acknowledges AI assistance per UT integrity policy (PRD G1 decision dependency) |

### Phase 0.2 — pilot delivery (target: 2026-08-31, but Prague kicks early June 2026 — *tension noted in PRD §11*)

| Capability | Status |
|---|---|
| Per-student RAG / LLM tier override via Canvas roster | Tasks #12 + #14 — Implement Phase 0.2 |
| Bidirectional: instructor-side announcements drafted by Keplo, published to Canvas | Defer to GA |
| Pages + Modules sync | Phase 0.2 |
| Syllabus sync (UT Simple Syllabus surface) | Phase 0.2 |
| Webhook-driven sync (Canvas → Keplo on content change) | Defer to GA |
| Discussion threads sync (read-only) | Phase 0.2 |
| Quiz outcomes → Keplo evals framework | Phase 0.2 |

### Phase 1.0 — GA (target: 2027-01-15)

| Capability | Status |
|---|---|
| OAuth-based instructor auth (replaces token) | GA |
| LTI 1.3 launch from Canvas | GA |
| xAPI learning-record-store integration | GA per `project_classroom_architecture` |
| Grade-posting back to Canvas gradebook | GA |
| Federation-aware roster mirroring (multi-institution) | GA |

## 5. Decisions still pending

### D1 — Auth model
- **OAuth** (instructor-driven, browser-based; UX nicest; needs Canvas Developer Key registration with UT IT)
- **API token** (instructor pastes a personal access token; Phase 0.1 expedient)
- **LTI launch** (instructor launches Keplo from inside Canvas; powerful but heavyweight to build first)

**Recommendation:** Phase 0.1 = API token (expedient, no UT-IT dependency). Phase 1.0 = OAuth + LTI. Defer LTI 1.3 architecture decision to post-Prague.

### D2 — Sync direction
- **Pull-only** (Canvas → Keplo; instructor opts in; never writes to Canvas)
- **Bidirectional** (Keplo can publish announcements / quiz drafts back; explicit-approval gate)
- **Lockstep** (Canvas state mirrors directly; risky — Canvas changes silently overwrite Keplo)

**Recommendation:** Pull-only for Phase 0.1 + 0.2. Bidirectional opt-in starting GA (with explicit instructor approval gate per push).

### D3 — Sync frequency
- **On-demand** (instructor runs `axi classroom sync` manually)
- **Scheduled** (cron-style; Keplo polls every N hours)
- **Webhook-driven** (Canvas pushes change events; Keplo re-indexes)

**Recommendation:** On-demand for Phase 0.1; scheduled (daily) for Phase 0.2; webhook-driven at GA.

### D4 — Naming overlap with UT's "My Classroom" Canvas tool
- **Rename** Keplo CLI surface to avoid collision (e.g., `axi cohort` instead of `axi classroom`)
- **Keep** `axi classroom` and document the disambiguation
- **Investigate** what UT's "My Classroom" actually does first

**Recommendation:** Investigate first (we don't know what UT's My Classroom does). If it's an instructor dashboard with overlapping intent, rename Keplo's surface; if it's something orthogonal (e.g., a student-side classroom-finder), keep `axi classroom` and document.

### D5 — Tier-aware ingestion (per Hypothesis Ledger H7)
- **All-Canvas-content uniformly indexed** (current default; risks logistics-announcement noise on academic queries)
- **Auto-classify on ingest** (LLM tags each announcement / page; risks misclassification)
- **Instructor-tagged at publication** (UI surface: when Ondrej publishes, choose academic / cohort-logistics / cultural-context tier)
- **Per-tier RAG policies** (e.g., academic queries retrieve only academic-tier content; logistics queries can pull logistics-tier)

**Recommendation:** Phase 0.1 = uniform (all content indexed); Phase 0.2 = auto-classify + per-tier RAG policies. Instructor-tagged is the ideal but requires Canvas-side UI work that's out of scope; we approximate with classifier.

### D6 — Files indexing strategy
- **Naïve fetch + chunk** (download all course files; ingest into RAG)
- **Selective fetch** (only files referenced in announcements / pages / modules; saves storage + privacy surface)
- **Lazy fetch** (fetch when first referenced in a query; saves up-front cost but adds query latency)

**Recommendation:** Phase 0.1 = naïve fetch (instructor opts in; expedient). Optimize later.

### D7 — File format support
- **PDF** (highest priority — textbook + lecture slides + lab manuals)
- **DOCX / PPTX** (likely some material)
- **MP4 / Panopto videos** (transcript only? full video processing?)
- **Markdown / plain text** (already supported)

**Recommendation:** Phase 0.1 = PDF + plain text (primary value). DOCX / PPTX = Phase 0.2. Video = GA + 1 (large investment).

## 6. Risks

| Risk | Severity | Mitigation |
|---|---|---|
| **Naming collision with UT's "My Classroom"** | Medium | D4 investigation before instructor-facing terminology locks |
| **FERPA / consent surface unclear** for Files+Roster sync | High | Explicit consent UX in `axi classroom prep lms`; retention policy doc per PRD §11 G2 |
| **Canvas API rate limits** (esp. for big courses) | Medium | Webhook-driven sync at GA; backoff + caching |
| **IgniteAI's existence** sets baseline UX expectations | Low-Medium | Position Keplo as complement, not replacement; demo grounded synthesis vs. raw search |
| **Tier-classification errors** — logistics noise leaks into academic queries | Medium | Phase 0.2 classifier + instructor-tagged option |
| **Bidirectional drift** if instructor edits in both Canvas + Keplo | High | Pull-only in Phase 0.1+0.2; bidirectional with explicit gate at GA |
| **Auth-token leakage** | High | Per-instructor token rotation; never logged; secret-storage parity with `langfuse-prague.env` pattern |

## 6.5 Hard constraint — PII safety in test fixtures

When real-cohort data flows into our development pipeline (screenshots,
Canvas exports, materials uploads), the development pipeline **MUST**
scrub PII before persisting to any committed artifact:

- Test fixtures, Keplo `examples/` directories, paper appendices,
  journey docs, harness results — **never** include real student
  names from any cohort roster
- Synthetic identities only (`@alice:prague`, `@bob:prague`, etc.) per
  the principal naming convention
- Real names of colleagues / co-authors with explicit recorded
  permission (Ondrej, Khiloni Shah, James Terry per memory) are
  acceptable for *attributed* contributions
- Capture *structural* signal from real-roster sources (count, role
  distribution, section, last-activity patterns), never names

This is **FERPA-relevant**. The compliance surface (consent, sovereign
processing, audit, erasure) applies when Keplo handles real-roster
data in production; test fixtures avoid the entire surface by being
synthetic-only.

Codified as `feedback_pii_safety_in_test_fixtures` in session memory.

## 7. Cross-references

- Course canonical / Class instance separation: `axiom/docs/adrs/adr-034-course-class-federation.md`
- PRD: `axiom/src/axiom/extensions/builtins/classroom/docs/prd.md`
  (especially §5.1 Weekly mastery module, §6 Non-functional, §11
  Critical gaps G1-G3 + G7 web-vs-CLI reconciliation)
- Lead paper: `axiom/src/axiom/extensions/builtins/classroom/docs/papers/pedagogical-intent-rag-eval-draft.md`
  (especially §1 positioning text, §5 refusal-quality split, §A
  Hypothesis Ledger H7 RAG-tier proposal)
- Cohort metadata (instance-specific): `Neutron_OS/docs/cohorts/sp26-cze-prague-class.md`

## 8. Implementation tracking

This strategy is implemented through specific tasks tracked in the
session task list. Current relevant tasks:

- Task #12 — Add per-student RAG mode override (under unified `policy` command)
- Task #14 — Add per-student LLM tier override (dumb/standard/smart/smartest)
- Task #15 — Capture tuned Qwen defaults in rag_grounding preset config

New tasks to file based on this strategy:

- Build Canvas read-only API client (Phase 0.1)
- Replace `prep lms --fake` with `prep lms --canvas-course <id>` real integration
- Files sync (PDF first) into classroom local index
- Announcements sync with placeholder tier classification
- Assignments sync (read-only)
- Investigate UT's existing "My Classroom" tool (D4 question)

## 9. Open questions awaiting evidence

- [ ] Does UT IT have published Canvas Developer Key registration process? (D1 OAuth path)
- [ ] What's UT's existing "My Classroom" tool actually do? (D4)
- [ ] Is IgniteAI Search opt-in per course, or always-on? (relevant for instructor expectation-setting)
- [ ] Is Canvas API access scoped per-course or per-instructor / per-tenant? (informs auth-token shape)
- [ ] Do UT students use external AI tools (Claude Direct, ChatGPT, Copilot) alongside IgniteAI? (positioning context)
- [ ] What's the UT integrity-policy stance on AI-completed work? (relevant for Keplo's refusal-quality calibration)
- [ ] Does Ondrej have admin access to install / configure Canvas integrations beyond what's already there? (gates Keplo as a Canvas-listed app vs. external CLI tool)

## 10. Strategy evolution log

Append-only timestamped entries as evidence shapes the strategy.

### 2026-04-30 — Initial draft after Sp26 cohort observation
- Strategy initialized based on direct observation of UT Canvas
  surface for M E 336P / 1442954
- Empirical IgniteAI characterization (pure search, no synthesis,
  no file indexing, no refusal logic) sharpens Keplo positioning
- Identified D1-D7 as decisions still pending
- Phase 0.1 minimum viable scope locked: course identity binding +
  read-only API token auth + Files (PDF) sync + Announcements
  sync + Assignments sync + on-demand pull mode
- Highest-value-gap-from-real-cohort: Files sync (textbook PDF +
  lab manuals are where the high-value content lives, and IgniteAI
  doesn't index them — Keplo's distinctive contribution)
- New hypothesis seeded: H7 (RAG-tier-classification) — adopt
  uniform indexing for Phase 0.1, classifier-based tiering for
  Phase 0.2

### 2026-04-30 (later) — Instructor co-pilot capabilities added
- Discovery: Ondrej's published assignment shells (Lab 1-8, Quiz 1-8,
  Extra Credit) are **structural only** — no content inside yet
- Strategy expanded with **Capability A** (course-shell bootstrap from
  empty state) and **Capability B** (content auto-fill for existing
  shells) — see Phase 0.1 expansion section above
- Pivots Keplo's value proposition: not just "another AI tutor"
  (UT students have IgniteAI + commercial AI), but **instructor
  productivity tool that also serves students** (UT instructors
  don't have this). Same RAG foundation, two-sided value.
- Paper #4 framing reinforced: "The Tutor That Shows Its Work" —
  Keplo shows its work for student answers AND instructor proposals
- Phase 0.1 priority: Capability B (content auto-fill), instructor-
  in-the-loop draft → review → approve → publish-to-Canvas flow.
  Capability A (structure bootstrap) deferred to Phase 0.2 because
  proposing structure is architecturally harder and instructor
  trust-establishment matters first.

### [next entry — add as more evidence arrives]
