Open-RAIC v0.9.3

Open-RAIC v0.9.3

This is the first tagged release after v0.9.1. It includes the merged and deployed, but untagged, v0.9.2 stabilization work and the subsequent classroom, provider, and dependency fixes.

What changed

• Strengthened Google identity, logout, session, and readiness handling from the v0.9.2 stabilization work; retained provider governance and the existing Postgres storage model.
• Sanitized stored and rendered formulas, validated outbound provider destinations and redirects, and made quiz grading and ungraded feedback more reliable.
• Improved the no-key classroom demo and smaller-screen lesson layout, added a clear lesson-complete summary, preserved widget playback through mobile overlays, and bounded TTS responses.
• Updated Next.js to 16.3.8 and compatible dependency resolutions. braces@3.0.3 still has an upstream high-severity advisory with no fixed npm release. A local depth-limit patch is applied; the low-threshold dependency gate verifies its exact patch, lock binding, installed bytes, and behavior, and reports it as locally mitigated. GitHub currently shows that one open alert.

Release proof

• Source commit: 30afd159c206c9b6abd5e9af99897847e29fd9b8 (tree 5174cf314554493a340b2b63e33e32164e7dae42). GitHub CI passed all four jobs for this commit.
• A clean Node 24.19 / pnpm 10.28 ops:verify passed: dependency gate, localization, formatting, lint, TypeScript, 1,325 unit tests (3 existing skips), production build, 97 MiroFish contract tests (2 skips), 3 MiroFish browser flows, and 47 general browser flows (1 skip). A fresh four-budget synthetic benchmark and Node 24 Alpine Docker build also passed.
• Protected Preview dpl_AfbTNhokxn2si7RpDW68XKXa7mQV reached READY, preserved its SSO redirect, returned healthy version 0.9.3, and passed the no-key demo through quiz feedback and completion at desktop and phone width. Its source was a CLI upload with matching candidate metadata; Git provenance is established by the production deployment, not by that metadata.
• Git-triggered production deployment dpl_o3QKYbAWij8k6CgVaRfbCjALTFWK is READY, reports the source commit above, and owns open-raic.com. Live health returned version 0.9.3 with auth, encryption, and Postgres ready. The production milestone smoke passed 12 checks (4 optional features skipped); the classroom guard smoke passed 3 automated checks. The live no-key lesson completed with a 2/2 quiz result and no console warnings.

Limits and rollback

Signed-in teacher generation, share/join, scheduling, and source-document upload were not independently completed for this release. The protected Preview has no configured source-document smoke secret, and the production smoke lists five signed-in classroom steps for operator review. No paid model call or real student data was used in this release check. MiroFish, TTS, video, and web search are optional capabilities and are not enabled as release requirements.

If this application build regresses, restore the previous known-good production deployment dpl_HFVsa83hvR4H1aRbuapZpMDTG4NA at commit 2aa083cddb237cd5e7f55de953abb9029d898c41, then recheck the domain and health endpoint. Application rollback does not reverse database writes or external provider effects.

Open-RAIC v0.9.1

Highlights

• Replaces the duplicate homepage demo card with one Explore differentiated demo link.
• Replaces the empty schedule panel with a compact Schedule class action.
• Presents populated schedules as a flat Upcoming classes section while preserving teacher Discord controls.
• Keeps the classroom composer in the first mobile viewport and constrains the agent selector on narrow screens.

Compatibility

This release makes no request, response, persistence, authentication, provider-governance, or capability contract changes.

Verification

• Complete Node 24 release gate and ops:verify passed.
• Unit suite: 1,009 passed, 3 skipped.
• Full Playwright: 40 passed, 1 intentional skip.
• MiroFish E2E: 3 passed.
• Production milestone smoke: 12 passed, 4 optional capabilities skipped.
• Production classroom smoke: 3 automated guards passed; 5 signed-in mutation checks remain explicitly manual.
• Live verification passed at 1680x1000, 390x844, and 320x568.

Production: https://open-raic.com

Rollback

Promote Vercel deployment GNSvVKhDsSGwYMgECjeR82UDJj2K or revert PR #84. No schema or data rollback is required.

Open-RAIC v0.9.0 Governed PDF Source Foundation

Highlights

• Adds teacher-authenticated, ownership-bound PDF uploads to a separate private Blob store.
• Introduces bounded internal document artifacts with PDF-only validation, a 50 MB direct-upload limit, 200-page and 200,000-character extraction limits, and a 50,000-character generation-context ceiling.
• Deletes raw PDFs immediately after extraction and adds hourly cleanup for abandoned uploads.
• Keeps /api/parse-pdf backward-compatible with a hardened 4 MB multipart boundary and sanitized errors.
• Adds the sourceDocumentsV2 health capability and a single-document source picker with upload, validation, warning, replace, and remove states.

Verification

• Protected preview accepted a 5,504,721-byte synthetic PDF, extracted it, generated a complete 10-scene source-required classroom, and confirmed the raw Blob was gone.
• Clean Node 24 release gates, full unit and browser suites, benchmark, and ops:verify passed on merged main.
• Production deployment dpl_HU5sasmpiYcA7vi7Ae8m1UVJfwQg passed health, milestone, and classroom guards.

Capability Truth And Rollback

Web search, TTS, video, and MiroFish remain unavailable in production. Disable the new upload path by removing RAIC_SOURCE_BLOB_READ_WRITE_TOKEN, or roll back to the recorded v0.8.1 production deployment. No database migration is required.

Open-RAIC v0.8.1 Dependency Security

Dependency security\n\n- upgrades Vitest, Vite, Undici, js-yaml, ECharts, Vercel Blob, and LangChain to patched compatible lines\n- constrains residual transitive advisories with documented temporary pnpm overrides\n- adds a low-threshold locked-dependency audit to CI and a weekly scheduled workflow\n- closes all 34 previously open Dependabot alerts\n\n## Compatibility\n\nThis release makes no public request, response, persistence, or capability behavior changes. Production capability reporting remains unchanged and truthful: web search, TTS, video, and MiroFish remain unavailable until separately configured and proven.\n\n## Verification\n\nNode 24.14 / pnpm 10.28 frozen install, zero dependency advisories, full unit/build/MiroFish/Playwright gates, benchmark budgets, canonical ops verification, protected preview, production health, and production smoke checks all pass.

Open-RAIC v0.8.0

Highlights

• Adds the governed-co-thinking Course-mode preset with focused prompt context and complete en-US, zh-CN, zh-TW, and ja-JP localization.
• Adds a teacher-only agency reflection template using the existing reflection storage contract; no database migration or research-scoring model is introduced.
• Resolves the shared dialog close-state issue and preserves disabled student adaptation.
• Extends provider-error redaction through LLM, outline retry, and asynchronous classroom-generation logs.

Reliability

• Includes the v0.7.1 generated-widget iframe isolation, bounded scene retries, retry telemetry, and networking/SSRF/provider-URL hardening.
• Production capability reporting remains truthful: image generation is ready; web search, TTS, video, and MiroFish remain unavailable and were not enabled for this release.

Verification

• Released from 01ebcd3f10dfc662b9a96a01d6ce1676b58e69b3.
• Complete Node 24 gate passed: secrets, drift, i18n, TypeScript, formatting, lint, 974 unit/route tests, build, MiroFish contract/E2E, 36 Playwright scenarios, benchmark, and ops:verify.
• Production deployment dpl_6FkoZ8eSsW1wanT3Pvh4eCuQaVZF is ready at open-raic.com.
• Production milestone smoke: 12 passed, 0 failed, 0 blocked, 4 optional capabilities skipped.
• Production classroom smoke: 3 automated guards passed, 0 failed.

See docs/release-evidence-v0.8.0.md for the detailed evidence record.

v0.7.1 Reliability Hardening

Open-RAIC v0.7.1 hardens generated classroom experiences without changing public API contracts.

• isolates generated srcDoc widgets while preserving URL-backed embeds and MiroFish
• adds bounded transient retries for scene content and actions with sanitized internal telemetry
• expands SSRF, loopback, NO_PROXY, provider URL, and proxy-log redaction coverage
• preserves source-required behavior when web search is unavailable

Release proof: all Node 24 gates, 960 unit tests, production build, MiroFish contract/E2E, 34 Playwright tests (1 credential-dependent skip), milestone benchmark, ops verification, production milestone smoke, and classroom guard smoke passed. Production health reports version 0.7.1 and keeps unavailable capabilities disabled.

v0.7.0 Discord Scheduled-Class Beta Readiness

Open-RAIC v0.7.0 completes the Discord scheduled-class production beta and its release-hardening closeout. Production health confirms auth, Discord, encryption, storage, and image generation are ready; web search, TTS, video, and MiroFish remain explicitly unavailable. The existing immutable v0.7.0 tag is unchanged.

v0.5.0 Source-Grounded Experience Presets

v0.5.0 is the next public release after v0.3.0. It includes the completed v0.4.0 Reliable Adaptive Learning Platform work plus the Source-Grounded Experience Presets milestone.

Highlights

• Adds the History Vlog source-grounded experience preset with fact-checks, reconstruction labels, AI caveats, and normal classroom scene generation.
• Adds classroom source visibility metadata and UI labels for PDF, web, PDF+web, or no external source context.
• Hardens History Vlog source requirements so filename-only PDF metadata cannot satisfy source guardrails.
• Includes the v0.4.0 platform work: Provider Composer scene routing, fail-closed provider hardening, and private teacher/internal learning analytics.

Verification

• PR #50 CI: https://github.com/spheng51/RAIC/actions/runs/26003936426
• PR #51 CI: https://github.com/spheng51/RAIC/actions/runs/26033030847
• Vercel deployment for release-doc closeout: https://vercel.com/vangorestudios-6959s-projects/raic/3va1oGV2AdgAPbgG7rNxKE9eThFd
• Local Node 24 release gate passed on clean main: secrets:scan, ops:drift, check, lint, build, MiroFish gates, full E2E, milestone benchmark, and ops:verify.

Next

• v0.5.1: Source-Grounded Hardening for History Vlog source failures, web-search fallback behavior, source-mode metadata, and small source-required UX/docs improvements.
• v0.6.0: Adaptive Student Beta Readiness after privacy, consent, retention, public API, feature-flag, rollback, and non-leakage review.

v0.3.0 Adaptive Classroom Intelligence

v0.3.0 Adaptive Classroom Intelligence

Highlights

• Activates teacher-only repeated-session intelligence for classroom generation.
• Reuses persisted session progress and latest teacher reflection to adapt new classroom outlines, scene content, scene actions, and runtime chat behavior.
• Keeps public, student, publish, generation, and game-session HTTP API shapes unchanged from v0.2.1.
• Preserves fail-open behavior for first-run teachers, public demo users, anonymous users, student sessions, and classroom-cookie-only flows.

Final Release Evidence

• Tag: v0.3.0
• Commit: 1c2d0ac3e5a0be2f42de19999c1ad1fb0efc7636
• Production deployment: dpl_4PFqat8TQP3jVymgmxRZBuYAkhfM READY from the tagged commit.
• Vercel env readiness recorded by dashboard fallback: BLOB_READ_WRITE_TOKEN present via private raic-blob; DATABASE_URL, RAIC_SECRET_ENCRYPTION_KEY, Google OAuth IDs, and OPENAI_API_KEY present per dashboard/smoke evidence. Automated ops:env:vercel skipped because no VERCEL_TOKEN/VERCEL_API_TOKEN was available.
• Signed-in teacher QA recorded: create/open teacher classroom, complete scenes, save reflection, revisit/regenerate/chat, and confirm adaptation appears only for authenticated teacher repeat flow.

Verification

• Node release runner: v24.15.0 for node and pnpm exec node.
• corepack pnpm run secrets:scan: passed.
• corepack pnpm run ops:drift: passed.
• corepack pnpm run check: passed.
• corepack pnpm lint: passed.
• corepack pnpm run build: passed.
• corepack pnpm run test:mirofish:gate: 20 files passed, 97 tests passed, 2 skipped.
• corepack pnpm run test:mirofish:e2e: 3 passed.
• CI=1 corepack pnpm run test:e2e: 31 passed, 1 skipped.
• corepack pnpm run benchmark:milestone: passed; artifact 2e9e593f-fda1-4b56-952f-d252099b9940.
• corepack pnpm run ops:verify: all verification gates passed.

Production Smokes

• corepack pnpm run smoke:production:milestone: 11 passed, 0 failed, 0 blocked, 4 skipped.
• corepack pnpm run smoke:production:classroom: 3 automated passed, 0 failed, 5 manual checks listed.

Known Deferred Work

• Provider Composer remains queued for v0.3.1.
• Learning Analytics + Reflection remains queued for v0.3.2.
• Student-facing adaptive experience remains queued for v0.4.0 after privacy, consent, retention, and public API review.
• Discord scheduled-class sync remains deferred unless it becomes part of the public release surface.