Activity

1. pullfrog commented on Sep 22, 2026

   

   pullfrogBot

   on Sep 22, 2026 – with Pullfrog

   Last edited by pullfrog

   More actions

   Run failed. View the logs →

     ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using openai-compatible/glm-5.3 ｜ 𝕏}
2. pullfrog

   added

   area: assessmentsquizzes, submissions, instructor toolsquizzes, submissions, instructor tools

   area: ciCI, tooling, release automationCI, tooling, release automation

   type: choreMaintenance and toolingMaintenance and tooling

   on Sep 22, 2026
3. rabesss

   added a commit that references this issue on Oct 1, 2026

   chore: make the CLI Lighthouse-only; drop the trial connection (#46)

   ...

   5ec5670
4. rabesss commented on Oct 1, 2026

   

   rabesss

   on Oct 1, 2026

   OwnerAuthor

   More actions

   Status update (2026-10-01)

   Merged: #46 (Lighthouse-only; no --site, no trial connection), #47 (read-only submit --dry-run), #49 (hold mando<0.8 for radon) and the Dependabot updates #38 #39 #40 #41 #44 #50 #51.
   Closed: #28 and #25 (site binding is moot after #46), #36 (the trial cannot provide a learner).
   Retitled: #33 and #34 now describe Lighthouse-only work.

   Trial testing now runs through an out-of-repository harness that refuses non-sandbox hosts and blocks Lighthouse sign-in commands; the product code has only a private connection override.

   Next, in order:

   1. Student quiz attempt command: blocked on an owner-driven passive capture of a practice/ungraded Lighthouse quiz (summary → start → answer → submit → receipt). Scope after the capture: untimed multiple-choice quizzes first, a read-only info preflight, confirmation before start/next/submit, and at-most-once dispatch with verified outcomes.
   2. [P2] Add role course, semester, and content discovery #33 role discovery reads, then [P2] Add learner text assignment submissions #34 text submissions, [P2] Verify and implement draft-only instructor assignment feedback #35 and [P3] Establish supported quiz question-authoring capability and blockers #37.
   3. Reduce CLI startup latency by deferring legacy command imports #27/perf: defer legacy command imports #29 startup latency: decide between the current lazy-export design and a smaller function-local-import version.
   4. Release workflow: fails on every push to main because Actions may not create pull requests (a repository setting).
5. rabesss commented on Oct 14, 2026

   

   rabesss

   on Oct 14, 2026

   OwnerAuthor

   More actions

   Roadmap

   Refreshed 2026-10-14 (previous refresh 2026-10-05). This replaces the 2026-09-22 execution map; its history is in the comments below and in the merged PRs.

   Where things stand

   The CLI is Lighthouse-only (#46).

   Since the 2026-10-05 refresh:

   • Fixes from real-world runs (fix: clearer messages for an ended session, quiz help and unsupported pages #70, fix: report a quiz grade shown only as a percentage #71, fix: say why a closed assignment's history is refused #72):
     • When student attempt or preview is refused at the session check, the message now says the session may have ended or the account may lack API access, instead of only "Permission denied".
     • A quiz grade shown only as a percentage is reported.
     • When Brightspace refuses a learner's assignment history because access is restricted after the end date, the message says when the assignment closed.
   • fix: refuse submit to a folder that takes no file #73: submit (and submit --dry-run) refuses a text-only, on-paper or observed assignment before reading or sending the file. This settles [P2] Add learner text assignment submissions #34 (see below).
   • Closed:
     • Use Z.AI Coding Plan GLM 5.3 max for hosted Droid review #22: Droid reviews on the GLM 5.3 plan run locally, because the hosted runner cannot reach that endpoint.
     • [P2] Add role course, semester, and content discovery #33: its reads already exist in top-level commands.
     • [P2] Add learner text assignment submissions #34: Brightspace documents no text-only learner submission route.
     • feat: add experimental Outlook probe and selected-message reader #52: the experimental Outlook reader, now out of scope.

   Up to the 2026-10-05 refresh:

   • Learner quiz attempts shipped (docs: record timed-quiz start, timer and time-up protocol #56, docs: record learner quiz resume, save and submit protocol #58–feat: take timed quizzes as a learner #64, feat: move back a page in a learner attempt #66, fix: say when Brightspace is still submitting a timed-out attempt #69): student attempt start, page, answer, next, previous, images, submit, verify, forget and status.
     • Question types: single choice, true/false, multi-select and fill-in-the-blank.
     • Layouts: one question per page, all questions on one page, and forward-only.
     • Content: equations read as LaTeX; images become numbered markers, and images downloads them.
     • Timing: timed and auto-submitting attempts.
     • Safety: start, Next and submit are sent at most once, and every change is read back before it is reported.
   • Startup and CI:
     • perf: load the HTTP stack only when a role command runs #53 loads the HTTP stack only when a role command runs (closes Reduce CLI startup latency by deferring legacy command imports #27).
     • ci: cut Actions minutes per PR and drop the failing release job #54 uses fewer Actions minutes per PR and drops the release job that failed on every push.
     • ci: pin droid-action to the v9 release #57 pins droid-action.
   • Cleanups with no change in behaviour: refactor: cut 1,715 lines with no change in behaviour #65 (1,715 fewer source lines) and test: cut 7,196 test lines with the same checks #67 (7,196 fewer test lines).
   • Output fix: fix: all-courses output from worker threads: Rich everywhere, courses kept whole #68 sets up Rich safely from worker threads and prints each course's output together.
   • Dependencies: chore(deps-dev): bump the dev-toolchain group with 3 updates #55.

   Closed earlier: #24 (fixed by #45), #25 and #28 (moot after #46), #27, #32 (via #30), #36.

   Now: validate the learner attempt flow on more Brightspace sites

   The protocol and transport were checked on a public Brightspace site and a disposable sandbox. The CLI commands were then checked on the sandbox through its "View as Student" role. A first round with learner accounts on D2L Open Courses and Modern States produced the fixes in #70 and #71. Before adding features, keep running the current CLI on Brightspace instances that give free learner access to quizzes, and record what it handles and where it breaks.

   • Harness: testing runs through the out-of-repository harness, which pins the connection to one sandbox origin and blocks Lighthouse sign-in. The product stays Lighthouse-only and gains no site-selection option.
   • Accounts and quizzes: use throwaway accounts that the owner creates, and only quizzes meant for practice. The instructor side (building quizzes in each configuration) is tested on the disposable sandbox; the learner side runs on public Brightspace sites with free learner access. Lighthouse itself is not written to unless the owner asks.
   • What to record per site:
     • How sign-in works.
     • Quiz layouts, question types, equations and images, timing, auto-submit and attempt limits.
     • For each command, whether it worked, refused safely, or failed.
     • Wall time and request count per step.
   • Failures: each one gets its own issue, with a sanitised page fixture and a failing test, and its fix ships as a separate PR.

   On hold (owner decision, 2026-10-05)

   • [P2] Verify and implement draft-only instructor assignment feedback #35: draft instructor feedback.
   • [P3] Establish supported quiz question-authoring capability and blockers #37: question authoring. LE 1.100 adds documented quiz-question routes, but Lighthouse reports LE 1.99, so this stays on hold (evidence in the [P3] Establish supported quiz question-authoring capability and blockers #37 comments).

   Their order is unchanged once the validation round is done. These issues predate the Lighthouse-only change, so before resuming one, read the current AGENTS.md, REVIEW.md, README and docs/quiz-protocol.md, and reconcile its instructions with main:

   • --site and trial support were removed from the product.
   • perf: defer legacy command imports #29 was superseded by perf: load the HTTP stack only when a role command runs #53.
   • docs/assessment-coverage.md no longer exists.

   #26 stays the umbrella issue; its boxes are ticked only with live evidence.

   Rules that still apply

   • Isolation and output: keep site and account isolation and the sealed credential store. Never log secrets or user content. With --json, stdout carries only JSON; prompts, progress and diagnostics go to stderr.
   • Writes:
     • Never automatically retry a request that creates state.
     • An HTTP 200 alone does not verify a write.
     • LMS writes, merges and pushes need explicit authorisation.
   • Gate: run the full gate before review: ruff check, strict mypy, import contracts, deptry, the complexity ratchet, repository policy tests, pytest with coverage, and both secret scans. Formatting is by hand, with no ruff format.
   • Required checks on main: lint / types / architecture / deps, tests (py3.10) and tests (py3.13). The secret scans and policy tests run inside these jobs.
6. rabesss commented on Oct 15, 2026

   

   rabesss

   on Oct 15, 2026

   OwnerAuthor

   More actions

   Update (2026-10-15)

   Merged since the 2026-10-14 refresh:

   • feat(auth): opt-in unattended sign-in with a stored authenticator #76: opt-in unattended sign-in. auth totp-setup seals an authenticator-app secret next to the saved credentials. After that, auth login needs no prompt as long as the saved username matches, no --totp is given and the MFA method (flag or LIGHTHOUSE_MFA_METHOD) is unset or app. A replay-safe read whose session has expired signs in once and retries once. Write requests, the quiz-attempt flows, submit --dry-run and other connections never sign in on their own. A write command's earlier reads can sign in first, but the write itself is still sent only once. After an expiry on one of those paths, run auth login. After an auth failure, a breaker blocks automatic attempts until a stored auth login succeeds or auth totp-setup or auth totp-remove runs; a network failure gives a 5-minute cooldown. auth status now checks whoami and reports renewed and unattended_login. Tested read-only on Lighthouse: setup and login, deleted cookies, an expired session, and two processes at once. Details: docs/auth-unattended.md.
   • fix(auth): say when the Microsoft password has expired #77: expired-password message. When Microsoft answers with its "Update your password" page (AADSTS 50055 or 50144), auth login and auth verify say the password has expired and should be changed in a browser, instead of the generic "Authentication failed". With feat(auth): opt-in unattended sign-in with a stored authenticator #76, the same page blocks automatic sign-in as credentials_rejected.

   Learner side. The plan above is unchanged. Still open:

   • student attempt has not been run on a real Lighthouse quiz yet. Next, as planned above: keep running it on public Brightspace practice quizzes through the harness. A Lighthouse quiz run is still outstanding and happens only when the owner asks for it. Extra time and reopened attempts are still unobserved.
   • Question types other than single choice, true/false, multi-select and fill-in-the-blank are refused, and the page has to be finished in a browser. So are unclear MathML, SVG, audio and video, password-protected quizzes and LockDown Browser.
   • Not implemented: group assignment submission, discussions, checklists and surveys (docs/quiz-protocol.md, "Not yet implemented"). Text-only learner submission stays unavailable ([P2] Add learner text assignment submissions #34).

   Known follow-ups (listed in #76 under "Not in this PR"; no issue yet):

   • auth refresh --cdp-port doesn't work with Helium: its debug port has no /json/version, and Network.getAllCookies isn't available on the browser target.
   • On systems without fcntl (Windows), student attempt and instructor preview fail when they load, because quiz_learner_session.py and quiz_preview_session.py import fcntl at module level. Other commands, including the quiz and quizzes reads, are unaffected.

   #35 and #37 stay on hold as above.