THE BIG PICTURE, MADE CLEAR
The system at a glance
Follow learning through the platform. See where identity is checked, where records live and where optional services join the journey.
An illustrative sequence across visitor, author, manager and learner roles—not one person’s permission set.
Public experience
Prerendered product pages, sample learning and documentation introduce the LMS. The explicit interactive demo is separate from private company records.
Public content never reads tenant learning records.
Explore this feature →Illustrative paths, not live execution or timing. Every protected operation passes through Go’s authority checks; diagram arrows omit repeated checks for readability. No model calls or external actions occur. Motion is optional and respects device preferences.
Always underneath.
Keycloak establishes identity; OpenBao-backed keys protect defined sensitive data. Auto-unseal remains deferred.
PostgreSQL stores company records; River handles supported background jobs. Side effects have operation-specific retry rules.
Adapter-backed storage holds files and evidence. Downloads and isolated package hosts apply their own access boundaries.
HTTPS, health checks, audit evidence and tested recovery are installation responsibilities. Off-server backups remain a TODO.
Read the complete system map
The following descriptions are the text equivalent of every map stage.
Public experienceDiscover · samples · docs
Prerendered product pages, sample learning and documentation introduce the LMS. The explicit interactive demo is separate from private company records.
Public content never reads tenant learning records.
Detailed guide →Identity & membershipKeycloak · SAML / OIDC
The browser signs in through Keycloak and returns to the Go backend. The LMS checks approved identity links, active membership and the intended company.
Authentication is not authorisation. SSO does not automatically provision members.
Detailed guide →Go application boundarySession · role · scope · CSRF
Go composes domain modules and checks current actor/company scope for each operation. Protected browser writes require Origin and CSRF validation.
This is the mandatory authority boundary, not a client-side role selector.
Detailed guide →Create & reviewModules · sections · preview
Authors build and autosave drafts, organise modules, review quizzes and preview supported activities. Resource and AI helpers remain subject to the author’s permission.
Draft edits and preview do not change assigned published versions or create learner credit.
Detailed guide →Publish & assignImmutable versions · scope
Explicit publication creates a course version. Managers assign published learning to authorised recipients, with deadlines and versioned enrolments.
Publishing and assigning are separate explicit actions with separate authority checks.
Detailed guide →Learn & resumeReading · quizzes · video
Learners use their assigned version. Supported activity submissions update progress through Go; acknowledgement matters when a connection is interrupted.
A page view or playback event alone does not prove completion.
Detailed guide →Optional AI assistanceApproved providers · selected text
Opted-in authors request a course proposal or answers from selected resources. Go enforces consent, bounds, quota, quotation checks and source revalidation; authors review before use.
No autonomous publication or tool execution. No PDF ingestion or whole-library retrieval in this pilot.
Detailed guide →Durable company recordsPostgreSQL · tenant policies
Course versions, enrolments, progress, evidence requests and domain state persist under tenant boundaries. River jobs handle supported background operations.
A queued task is not completed work. Every output retains its own access and retry rules.
Detailed guide →Isolated learning packagesSCORM 1.2 · validated saves
Approved, scanned package versions launch on isolated content hosts. Runtime state and acknowledged completion return to the LMS.
Requires scanning/hosting setup. Exact exports need compatibility qualification.
Detailed guide →Insights & exportsScoped charts · report jobs
Dashboards summarise authorised workspace records. Requested exports run as background work and downloads recheck current permissions and expiry.
Dashboards can be bounded. A ready report does not grant permanent download access.
Detailed guide →Achievements & evidenceCompletion · render · storage
Validated completion can create evidence and certificate-render jobs. Ready objects are made available through authorised delivery paths.
Completion and rendered-file availability are different states; no accreditation claim is implied.
Detailed guide →Messages & event deliveryExplicit send · optional channels
Reviewed messages produce in-app records and optional email jobs. Configured analytics/marketing destinations use their own event and consent controls.
Learning completion does not automatically send all notification templates. SMTP/provider acceptance is not delivery or attribution.
Detailed guide →