# Metis courseware workbench — design **Status:** authored current-state and proposed-target record. **Not ratified** — see §6. This document answers M0.13 of `V1_DOMAIN_WORKBENCHES_TODOS_2026-07-23.md`. It distinguishes live behavior, partial behavior, test fixtures, and proposed contracts; a proposal is never presented as current implementation. Team labels below are accountable functions, not fabricated named approvals. Every unresolved choice is an ADR in §5, and the absence of named ratification remains an explicit blocker. ## 1. Charter, governance, and traceability (M0.13.a) ### 1.1 Scope and owners The scope is the Metis courseware lifecycle from source intake through authoring, multidisciplinary review, publication, learner delivery, correction, interoperability, evaluation, and operations. Canonical technical ownership is divided among `metis-product-and-architecture`, `metis-authoring`, `metis-assessment`, `metis-learning`, `metis-interoperability`, `metis-release-governance`, and the cross-cutting security/privacy/accessibility/data-governance functions. No team label substitutes for the named people M0.13.f requires. ### 1.2 Requirements traceability | Requirement | Technical status | Sections | Blocker | | ----------- | -------------------------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | | M0.13.a | complete | 1, 7 | none | | M0.13.b | complete | 2 | none | | M0.13.c | complete | 3 | none | | M0.13.d | complete | 4 | none | | M0.13.e | complete | 5 | none | | M0.13.f | pending-named-ratification | 6 | No named domain, security, privacy, accessibility, engineering, or product reviewers have approved an effective revision or resolved the review log. | ### 1.3 Terminology | Term | Meaning in this document | | --------------- | ----------------------------------------------------------------------------------------------------------------- | | live | A tracked production code path exists; this is not a claim of launch readiness. | | partial | Some executable behavior exists, but a named boundary, control, or proof is absent. | | fixture | Deterministic test or demonstration data; never evidence of production behavior or outcomes. | | proposed | A versioned design/contract/target that is not yet fully adopted or ratified. | | canonical owner | The only authority allowed to mutate the durable fact; projections remain rebuildable. | | revision | Immutable content or evidence identity to which decisions and relationships are pinned. | | maturity | Authoring/review readiness, independent from publication, learner, mastery, grade, and integrity state. | | release gate | A fail-closed prerequisite for a specific publication candidate and policy context. | | audience | One of authoring, institutional setup, educator operations, learner delivery, observer, or operator adjudication. | | ratified | Every required named reviewer approved the same version, open issues are resolved, and an effective date exists. | ### 1.4 Evidence and decision format Every factual claim names a committed source in §7, whose SHA-256 is generated from repository bytes. Evidence rows state counts and gaps; they do not infer deployment truth beyond the source. ADRs state decision, owner function, options, consequence, status, and evidence. Review comments must record author, role, document version, disposition, resolution evidence, and timestamp; §6 intentionally contains no invented comments or approvals. ## 2. Current state (M0.13.b) | Area | Status | Current finding | Evidence | | ----------------------------------- | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------- | | Routed applications | live | 152 tracked routes span 4 surfaces; 105 routes have no route-level test. | `evidence/v1-workbenches/metis-route-inventory.json` | | Canonical service API | live | 882 canonical operations exist; 869 declare response schemas and 47 are open routes. | `evidence/v1-workbenches/metis-api-inventory.json` | | Metis packages | partial | 28 packages expose 6686 mapped capabilities; 12 packages have no consumer despite complete disposition rows. | `evidence/v1-workbenches/metis-package-inventory.json` | | Contracts | partial | 3685 OpenAPI schemas collapse to 3483 logical shapes with 199 multi-variant names; shared contracts add 600 Zod schemas. | `evidence/v1-workbenches/metis-contract-inventory.json` | | Persistence and deployment | partial | 71 tables and 5 production consumers remain in the shared topology; 56 tables carry a tenant key and production volume is unknown. | `evidence/v1-workbenches/metis-persistence-inventory.json` | | Content hierarchy contract | proposed | 13 kinds, 10 containment rules, and 8 lifecycle relationship policies are contract-defined; runtime adoption remains later work. | `evidence/v1-workbenches/metis-content-hierarchy.json` | | Authoring maturity contract | proposed | 10 independent states and 14 guarded transitions are contract-defined across 6 protected owners; legacy APIs still need migration. | `evidence/v1-workbenches/metis-authoring-maturity.json` | | Threat controls and launch gates | partial | 23 controls cover 60 cases (11 implemented, 10 partial, 2 contract-defined); 6 launch gates are blocked. | `evidence/v1-workbenches/metis-threat-model.json` | | Regional and institutional policy | proposed | 16 engineering rules exist, but 8/8 applicability cells await named legal/privacy review. | `evidence/v1-workbenches/metis-regional-policy.json` | | Success measures | proposed | 32 metrics cover 6 families; all 32 targets are proposed and 0 are ratified. | `evidence/v1-workbenches/metis-success-metrics.json` | | Automated test and fixture evidence | fixture | 1197 test files supply automated evidence, including deterministic fixtures and probes. Fixture evidence proves contracts and controls only; it is never labeled production behavior or outcome evidence. | `evidence/v1-workbenches/metis-code-census.json` | ### 2.1 Applications, routes, and deployments The route inventory records 152 routes over four surfaces: standalone Metis admin/web and Oshun web/operator mounts. A tracked route is live code, not a canonical-host decision: 1 artifact records a proposed logical owner/facade boundary, 0 artifacts ratify an effective canonical host, and 105 routes lack route-level tests. The service, workers, gateway, and current persistence consumers are tracked code paths; production volume, tenant keys, and ratified topology are not established. ### 2.2 Contracts, stores, flows, tests, and fixtures The canonical service exposes 882 operations. OpenAPI contains 199 multi-variant logical names, so response/request projections must not be mistaken for competing owners. The content hierarchy and authoring maturity models are proposed contracts until each write path adopts them. Test fixtures exercise contracts and failure behavior; they do not prove real learner, institution, or deployment outcomes. ## 3. Product and technical architecture (M0.13.c) ### 3.1 Hosts, audiences, and roles **Canonical host decision:** pending ADR-M013-001. Current hosts remain an inventory, not an approved target map. | Audience | Current routed paths | | --------------------- | -------------------- | | authoring | 54 | | institutional-setup | 64 | | educator-operations | 3 | | learner-delivery | 20 | | observer | 1 | | operator-adjudication | 10 | | Required workbench role | Authorization declarations | Workflow declarations | | ----------------------- | -------------------------- | --------------------- | | creator | 1 | 0 | | instructional-designer | 0 | 0 | | teacher | 6 | 1 | | sme | 0 | 1 | | psychometrician | 0 | 1 | | accessibility-reviewer | 0 | 0 | | integrity-reviewer | 0 | 0 | | publisher | 0 | 0 | | tenant-admin | 0 | 0 | The six audiences are complete classifications, but the nine workbench roles are not one authorization alphabet. Until ADR-M013-002 is ratified, routes and fields must use the narrower current authority and deny duties that cannot be expressed. Learner delivery never inherits authoring, answer-key, integrity, institutional, or operator projections. ### 3.2 Pedagogy and content model The proposed canonical hierarchy is source collection → source → course → module → lesson → objective → activity → stimulus → assessment → item → rubric → alignment → prerequisite. Relationships pin exact revisions/hashes, answers remain protected references, reuse is explicit, and deletion/correction invalidates dependent projections. Authoring maturity has its own guarded state machine; publication, attempt, mastery, completion, grade, and integrity retain separate owners. ### 3.3 Data, contracts, APIs, jobs, and events Current persistence has 56 tenant-scoped tables. The target boundary is owner-qualified IDs plus immutable, versioned, rebuildable projections and outbox/inbox delivery—never simultaneous dual-authoritative writes. The Python service owns the canonical API; generated clients and workbench facades adapt it. The census records 296 public or runtime job/event entries, but declaration count does not prove one durable envelope; every migrated entry must carry tenant, aggregate version, correlation, causation, idempotency, and audit context. ### 3.4 Standards profiles | Profile family | Current evidence | Allowed claim | | ------------------------- | ----------------------------------------- | -------------------------------------------------------- | | LTI 1.3 Core / Advantage | Versioned operation matrix and API routes | implemented operations; conformance pending | | OneRoster 1.2 | Sync operation matrix | implemented operation; semantic profile pending | | QTI 3 | Item-bank import/export service and tests | partial item profile; package conformance pending | | Caliper 1.2 / xAPI / cmi5 | Event operations and profile rows | implemented operations; event semantics pending | | SCORM 1.2 / 2004 | Fallback package/runtime operations | fallback operations; compatibility certification pending | | CLR / Open Badges | Issue, verify, and CLR operations | implemented operations; credential profile pending | No row above authorizes a blanket standards-conformance claim; later M1 profiles own exact versions, required/optional fields, negative fixtures, semantic round trips, and consumer certification. ## 4. Experience, trust, evaluation, and operations (M0.13.d) ### 4.1 Experience direction **Visual thesis:** A calm, evidence-first courseware workspace where the authored hierarchy owns the canvas and provenance, review, and release state remain continuously visible in a quiet inspector. **Content plan:** - Persistent audience-aware navigation and course/location context. - One dominant hierarchy or editor workspace for the current authoring task. - A secondary inspector for evidence, accessibility, review findings, versions, and permissions. - A final explicit review or release action with blockers, consequences, and recovery path. **Interaction thesis:** - Selection moves context into the inspector without replacing or obscuring the primary workspace. - Review findings reveal and focus the exact affected content, source, rubric, or policy cell. - Maturity and publication transitions animate once, preserve spatial continuity, and expose reduced-motion and nonvisual equivalents. This is an operational workspace, not a marketing page: no hero, dashboard-card mosaic, decorative gradient, or ornamental motion. Typography, whitespace, dividers, and one semantic action accent establish hierarchy. Cards exist only where the card itself is a selectable content object. ### 4.2 Workbench journeys #### 4.2.1 Source intake and grounding **Audience:** authoring / creator / SME. 1. Select owner and scope 2. Ingest source 3. Inspect extraction and rights 4. Resolve findings 5. Approve exact evidence revision **Completion:** A versioned source bundle is approved and traceable to every supported claim. **Failure/recovery:** Quarantine, retain diagnostic evidence, and offer retry or human escalation without publishing. #### 4.2.2 Course hierarchy authoring **Audience:** authoring / instructional designer / teacher. 1. Choose objective 2. Compose hierarchy 3. Attach stimuli and activities 4. Map assessments and prerequisites 5. Submit exact revision **Completion:** Every required hierarchy edge, objective, and evidence reference validates. **Failure/recovery:** Focus the invalid edge or missing mapping; never flatten, duplicate, or silently repair semantics. #### 4.2.3 Assessment and psychometric review **Audience:** authoring / psychometrician / integrity reviewer. 1. Author protected item 2. Bind rubric and answer refs 3. Run correctness and accessibility checks 4. Inspect sample/uncertainty 5. Approve or request changes **Completion:** The item revision passes content, secrecy, accessibility, and applicable psychometric review. **Failure/recovery:** Keep answers protected, suppress unsafe cohorts, and return a reasoned revision request. #### 4.2.4 Multidisciplinary review **Audience:** educator operations / SME / accessibility reviewer. 1. Open assigned queue 2. Inspect content and evidence diff 3. Review discipline/accessibility/safety findings 4. Record independent decision 5. Verify invalidations **Completion:** All required duties approve the same immutable revision with separation of duties. **Failure/recovery:** Request changes with anchored findings; stale or conflicting decisions are rejected. #### 4.2.5 Publication, correction, and withdrawal **Audience:** educator operations / publisher. 1. Inspect release gates 2. Confirm rights and audience 3. Sign publication decision 4. Observe delivery receipt 5. Correct, supersede, revoke, or archive **Completion:** Only the approved revision reaches the intended audience with provenance and recovery evidence. **Failure/recovery:** Block delivery, preserve the prior trusted release, and route incident/correction work. #### 4.2.6 Institutional setup and interoperability **Audience:** institutional setup / tenant admin / operator adjudication. 1. Choose institution and profile 2. Validate credentials and scopes 3. Probe compatibility 4. Run bounded import/export 5. Monitor receipts and drift **Completion:** A pinned tenant/profile/version exchange succeeds with semantic and audit receipts. **Failure/recovery:** Fail closed with unsupported/lossy fields and no partial authoritative mutation. ### 4.3 Responsive, accessible, offline, and localized behavior | Concern | Design rule | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Desktop | Navigation, dominant workspace, and inspector may coexist; the workspace retains priority. | | Tablet | Navigation collapses; inspector becomes a resizable adjacent or modal region without hiding save/review state. | | Mobile | Linearize task, context, evidence, and action; use a labeled sheet for the inspector and keep primary targets at least 44×44 CSS px. | | Keyboard/screen reader | One logical heading order, landmarks, skip links, visible focus, announced validation summaries, and focus transfer to the exact finding. | | Motion | Respect reduced motion; status never depends on animation, color, hover, or spatial position alone. | | Offline | Fail closed for publish, review decisions, rights, destructive actions, and high-impact writes. Any future draft queue must expose sync/conflict state and exact base revision. | | Localization | Locale, language, script, region, and direction are explicit versioned content dimensions; fallback is declared and never silently substitutes assessment or accessibility semantics. | ### 4.4 Trust, safety, privacy, integrity, and rights The threat model records that 23 controls cover 60 cases (11 implemented, 10 partial, 2 contract-defined); 6 launch gates are blocked. The workbench exposes control status without turning a partial control into a green gate. Protected answers/rubrics, learner/grade data, integrity evidence, provider secrets, source rights, generated media, and audit evidence are audience-filtered. Every high-impact action binds tenant, actor, purpose, expected version, exact evidence revision, idempotency, separation of duties where required, and append-only audit evidence. 8 regional applicability cells await legal/privacy review, so consent, minors, education records, biometric/voice, retention, deletion, residency, processor, and transfer decisions remain launch blockers rather than UI-configurable promises. ### 4.5 Evaluation, observability, and operations The proposed catalog records that 32 metrics cover 6 families; all 32 targets are proposed and 0 are ratified. Flow measures are withheld when correctness, release, or critical-accessibility guardrails fail; small groups are suppressed; individual high-stakes automation is prohibited. Operational views must report freshness, source version, numerator/denominator, sample/privacy status, uncertainty, countermetrics, and gate state. Operators need queue/job correlation, source and model/provider versions, policy and release receipts, audit search, incident playbook links, retry/cancel authority, spend/capacity signals, and rollback/withdrawal progress. Unknown, stale, partial, blocked, suppressed, and not-configured remain distinct states. ## 5. Migration, compatibility, rollout, and decisions (M0.13.e) ### 5.1 Migration and rollout sequence | Phase | Forward action | Gate | Rollback | | ------------ | ------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- | | 0. Baseline | Freeze inventories, source hashes, owners, routes, contracts, and launch gaps. | All deterministic evidence checks pass. | Regenerate from the last trusted commit. | | 1. Decide | Ratify hosts, roles, data ownership, persistence, standards, and experience boundaries. | Named approvals bind one document revision. | Keep current authorities and deny unexpressible duties. | | 2. Adapt | Introduce generated clients, owner-qualified IDs, projections, route facades, and versioned envelopes. | Contract, authorization, tenancy, replay, and negative-leakage tests pass. | Disable adapters; current owner remains authoritative. | | 3. Rehearse | Backfill and shadow-read by tenant without dual-authoritative writes. | Counts, hashes, relationships, semantics, accessibility, and restore drills agree. | Discard projections and restart from recorded cursor. | | 4. Cohort | Enable capability and audience flags for internal then named tenant cohorts. | Quality, safety, accessibility, privacy, interop, SLO, and support gates pass. | Disable cohort flag and retain prior trusted route/release. | | 5. Cut over | Switch canonical routes/stores together; monitor receipts and reconciliation. | No orphan, version regression, leakage, stale approval, or unexplained metric regression. | Restore prior authority and replay durable outbox from cutover cursor. | | 6. Deprecate | Time-box redirects, remove facades/shadow paths, and archive decision evidence. | Compatibility window ends and consumers acknowledge migration. | Extend only through a reviewed ADR with owner and expiry. | Feature flags are tenant-, audience-, capability-, and profile-scoped; default is off. Flags cannot bypass authorization, rights, privacy, accessibility, integrity, or release gates. Deprecation records require owner, replacement, affected consumers, notice date, migration date, removal date, telemetry, and rollback window. ### 5.2 Compatibility rules - Preserve stable canonical IDs and immutable revision identity across route, store, and package changes. - Use explicit adapters for legacy route/schema/status aliases; never reinterpret an old label silently. - Return unsupported, lossy, or incompatible profile fields before mutation; no partial authoritative import. - Keep read compatibility longer than write compatibility; every write targets one owner and one version. - Sign or hash publication, export, migration, and rollback receipts and retain their source/evidence versions. ### 5.3 ADR register #### ADR-M013-001 — Choose one canonical host per retained capability and time-box every facade or redirect. **Status:** pending. **Owner:** metis-product-and-architecture. **Options:** Oshun-only host; standalone Metis hosts; audience-partitioned hybrid. **Consequence:** 4/80 capabilities currently span hosts; 1 artifact records a proposed logical boundary and 0 ratify an effective choice. **Evidence:** `evidence/v1-workbenches/metis-route-inventory.json`, `evidence/v1-workbenches/metis-canonical-host-map.json`. #### ADR-M013-002 — Ratify one role vocabulary and field/action authorization matrix. **Status:** pending. **Owner:** metis-security-and-product. **Options:** Map current identity roles to workbench duties; Add first-class workbench roles; Hybrid role plus scoped duty grants. **Consequence:** 6 authorization alphabets exist and 0 names all 9 required roles. **Evidence:** `evidence/v1-workbenches/metis-role-permission-matrix.json`. #### ADR-M013-003 — Ratify the bounded-hybrid persistence ownership strategy and migration. **Status:** proposed. **Owner:** metis-data-platform. **Options:** Shared public schema; Dedicated all-in-one Metis database; Bounded-hybrid owner stores and projections. **Consequence:** bounded-hybrid is proposed after 3 options, but 0 reviewers have approved it. **Evidence:** `evidence/v1-workbenches/metis-persistence-inventory.json`, `evidence/v1-workbenches/metis-persistence-strategy.json`, `docs/adr/ADR-M0.5-metis-persistence-ownership.md`. #### ADR-M013-004 — Ratify canonical data owners, classifications, purposes, retention, residency, and projection boundaries. **Status:** pending. **Owner:** metis-data-governance. **Options:** Metis owns every current row; Source domains own all shared facts; Per-aggregate owner matrix with rebuildable projections. **Consequence:** 4/6 categories are declared, 2 records are mixed or misclassified, and 0 ownership properties pass. **Evidence:** `evidence/v1-workbenches/metis-data-ownership-boundary.json`. #### ADR-M013-005 — Pin supported interoperability versions and conformance profiles before compatibility claims. **Status:** pending. **Owner:** metis-interoperability. **Options:** Current operation matrix as compatibility claim; Profile-by-profile certified support; Core profiles plus explicitly lossy adapters. **Consequence:** LTI 1.3, LTI Advantage, OneRoster 1.2, QTI 3, Caliper 1.2, xAPI/cmi5, SCORM, and CLR/Open Badges operations exist, but later M1 profiles own conformance and semantic round-trip proof. **Evidence:** `apps/metis/service/src/metis/services/lms_interop_matrix.py`, `apps/metis/service/src/metis/services/qti_service.py`, `evidence/v1-workbenches/metis-success-metrics.json`. #### ADR-M013-006 — Choose offline, mobile, locale, bidi, and accessible-media support boundaries. **Status:** pending. **Owner:** metis-experience-and-accessibility. **Options:** Online responsive web only; Offline read plus queued safe drafts; Full offline authoring with conflict resolution. **Consequence:** The design remains fail-closed: no offline mutation, locale fallback, or accessibility equivalence is promised until versioning, conflict, and content-variant contracts are ratified. **Evidence:** `docs/domains/metis/METIS_OPERATOR_TRAINING_AND_LAUNCH_CRITERIA.md`, `libs/metis/quality/src/compliance/wcag-checker.ts`, `libs/metis/quality/src/technical/accessibility-linter.ts`. #### ADR-M013-007 — Choose rollout cohorts, flags, compatibility window, deprecation dates, readiness gates, and rollback authority. **Status:** pending. **Owner:** metis-release-governance. **Options:** Big-bang replacement; Tenant cohort migration; Capability-by-capability strangler migration. **Consequence:** 0/3 registries agree and the shell represents 1/7 required launch states. **Evidence:** `evidence/v1-workbenches/metis-canonical-host-map.json`, `evidence/v1-workbenches/metis-registry-launch-state.json`. ## 6. Review and ratification (M0.13.f) **Decision:** pending named ratification. This generated document cannot approve itself. | Required review role | Named reviewer | Decision | Reviewed version/date | | -------------------- | -------------- | -------- | --------------------- | | domain | — | pending | — | | security | — | pending | — | | privacy | — | pending | — | | accessibility | — | pending | — | | engineering | — | pending | — | | product | — | pending | — | Approvals recorded: 0. Review comments recorded: 0. Effective date: none. Required review compares this revision against `V1/features/domain-metis.md`, the feature inventory and deep dives, route/package/API/contract/persistence evidence, current code anchors, and every open ADR. Each comment must be resolved, accepted with an owned follow-up and launch effect, or rejected with rationale. Domain, security, privacy, accessibility, engineering, and product must approve the same source-ledger hashes. Open blockers: - 6 threat-model launch gates are blocked. - 8 regional applicability cells lack legal/privacy approval. - 0 success-metric targets are ratified. - 1 artifact records a proposed logical owner/facade map; 0 artifacts ratify an effective canonical host map. - 56 current tables carry tenant keys. - 105 routes lack route-level tests. - The review comment log has no named reviewers, decisions, resolution evidence, or effective date. ## 7. Source ledger | Kind | Source | SHA-256 | | -------- | ------------------------------------------------------------------- | ---------------------------------------------------------------- | | evidence | `evidence/v1-workbenches/metis-route-inventory.json` | b0b4313b655682cb17f4399f4f99ee0d54b8ab2a5cb02f4328a7a0d6c633d930 | | evidence | `evidence/v1-workbenches/metis-package-inventory.json` | 1ebcfda629d224f29963e5ffdca4184c8ba143eb49047bf2bee7b3b427876f31 | | evidence | `evidence/v1-workbenches/metis-api-inventory.json` | 89f96be9d3fe4aac33b670a2c6d4a9eaa61f5fc044c11dac9e7347876bceb77b | | evidence | `evidence/v1-workbenches/metis-contract-inventory.json` | 740744271b88ed59e044de1702bd0831fa421864c242edd9e5f83f1280f23d95 | | evidence | `evidence/v1-workbenches/metis-persistence-inventory.json` | dc9acf4b9747f8eb370ea116be552e9886f195760abafddd7b76dcac59acb008 | | evidence | `evidence/v1-workbenches/metis-persistence-strategy.json` | 3a787e633c1ca4a545a558aed27c2d249d0c955c1e34543dff7470adc51d77a6 | | evidence | `evidence/v1-workbenches/metis-code-census.json` | 8b5450095b09f38c5606aaa04b33319b1266970723e29c6069233c564eaebea6 | | evidence | `evidence/v1-workbenches/metis-content-hierarchy.json` | 6e44e25d4f3c9efedcc996c3c0346b6bfbe3b471601cf74a5a5539d889c2dc5b | | evidence | `evidence/v1-workbenches/metis-authoring-maturity.json` | 8c4eaa3f19dcc7b5fb2e1498f8ee68d0c9a6656e98bd63cae84309b9e954eda8 | | evidence | `evidence/v1-workbenches/metis-threat-model.json` | bd7624dc6ec1f46431932824529c4e205c7262e8e6de399bcf4ea93675a4b64b | | evidence | `evidence/v1-workbenches/metis-regional-policy.json` | 6d071169ac8ce05bb8467cd3cef4d92e4d0c35e42598bb430adc1a22a1ba2657 | | evidence | `evidence/v1-workbenches/metis-success-metrics.json` | a90ad4ab6d24f8784438b2d276aae6d7d92846c0ee7b32b3c116633ad4401224 | | evidence | `evidence/v1-workbenches/metis-canonical-host-map.json` | 4f8fdf6b2431c195b0503f7ad8a796686949b4d50a7f0b47a201653c8937eebc | | evidence | `evidence/v1-workbenches/metis-audience-classification.json` | bc6e45bb8fb0811af1ae269b0f970606b36ab93635643be24995a7a72fdcb0c9 | | evidence | `evidence/v1-workbenches/metis-role-permission-matrix.json` | e1c8b7f93bc61c37847e92077a454c99486a48de5d05d3c7155a27d4067c7c16 | | evidence | `evidence/v1-workbenches/metis-data-ownership-boundary.json` | 70bce32f5080ec43abfbab8afb72f9f78dc9ec36aa43112f5b27624f734a4602 | | evidence | `evidence/v1-workbenches/metis-registry-launch-state.json` | aca637248e73b5224b15cbecb1a7dba4e635d061115a82a5d2e74f5c881aa5fc | | document | `V1/features/domain-metis.md` | c4461886e7e5c45290983a8d60d9fb49be47858c28b81369f42428702c1b5b61 | | document | `docs/releases/v1/domains/metis/feature-inventory.md` | e5191a9c0d57ff7a5a58daf0a6fd13e393932bf21c291ebe6d1c8c3aaa9c462b | | document | `docs/domains/metis/deep-dive/architecture.md` | 0b05e70de1c99759bf8c280138c2cb7d2fde5acd0b2a4e3c38082d2a1b4004ef | | document | `docs/domains/metis/deep-dive/features.md` | 25125699cf5d381d61a56dec2e7d2c4c23dbdf2c31568aaa2a69d7e795fcd24c | | document | `docs/domains/metis/deep-dive/specifications.md` | 109e6db506892cfcb2e0824182a6426d330f89757993ea72545a728047eef17c | | document | `docs/domains/metis/route-flow-decisions.json` | f80cc6809276da39ffa63038e155ad3ea8878481c678ab4915ddfb93025a5b57 | | document | `docs/domains/metis/package-capability-decisions.json` | ebf8046ab5aa45e82de4e2dff0330b632e9a63f0e84f6fabb163f1416cab9ce9 | | document | `docs/adr/ADR-M0.5-metis-persistence-ownership.md` | 8aada7b6f633388c77aae2b9cd4b27816b6f0e107c6a56020e2075e445d4eeb3 | | document | `docs/domains/metis/METIS_PUBLICATION_RELEASE_GATES_RUNBOOK.md` | d74f1e3f4d83466f4584f184b1c9758fe0379d73797c41a04e36320d83223048 | | document | `docs/domains/metis/METIS_OPERATOR_TRAINING_AND_LAUNCH_CRITERIA.md` | 4224bc40ba4416f17dd6deec67db7d029b6eb59771657754b5283a733b8c2ab3 | | document | `docs/releases/v1/specs/metis-mobile-strategy.md` | ccba8d2f231845b67c94e1d5fca5ec878b4153cd3053126870c560d2699d0c00 | | document | `docs/releases/v1/specs/metis-generation-and-tutoring-slos.md` | b31be3bdd5e75b2770932e539c9a26c2addd7fa832ff0ed458cf01f107348131 | | code | `apps/metis/service/src/metis/services/lms_interop_matrix.py` | 86feaa52b0970e3772189f663f8f4e20cdb2b4bf5b39c2da6d825620bfe4d32f | | code | `apps/metis/service/src/metis/services/qti_service.py` | b33a2bd55939adf0057c76f65b3eb8c322521f0f0cc0c3e67f98508f04293f4a | | code | `libs/metis/quality/src/compliance/wcag-checker.ts` | d6ecd0c583f094bc732766ae988a896893e2a8f7c22158de943e81e068a94645 | | code | `libs/metis/quality/src/technical/accessibility-linter.ts` | 3aca386fe1f5f6195b5fd197b466aea2cb053217d415babb11aca7b991168529 | Regenerate with `pnpm exec tsx scripts/v1-workbenches/generate-metis-design-doc.mts`; verify with `pnpm exec tsx scripts/v1-workbenches/generate-metis-design-doc.mts --check` and `pnpm exec tsx --test scripts/v1-workbenches/generate-metis-design-doc.test.mts`.