v2.0.0 — the two-role rebuild

Lumen 2.0.0 — the two-role rebuild. A three-role LMS becomes a learner-owned platform: every signed-in user can both author and learn.

The loop: tell the AI what you want to learn → a guided intake distils a structured (field-encrypted) learning brief → the AI builds you a private course (on the prod release walk: 4 modules / 16 lessons in ~50s on Groq Llama 3.3 70B) → learn it with the course-scoped, citation-grounded RAG tutor → optionally share it through an admin-moderated public catalog → anyone can clone & remix a listed course with immutable provenance → or bring your own provider key (BYOK: allowlisted providers, envelope-encrypted keys, non-dollar quotas).

Highlights

• Studio for all — capability-based authorization (can_author, can_publish_public, can_clone, …) replaces the instructor caste (ADR-0025)
• Define → build → learn — bounded 6-turn goal elicitation; honest, re-runnable, cancellable builds; private by default (ADR-0026)
• Moderated public catalog — share → pending_review → approve/reject/delist state machine, immutable audit, user reporting with a reason taxonomy, flag-not-auto-unlist (ADRs 0029/0030)
• Clone & remix — sanitized export projection, server-written "Based on…" provenance, idempotent via Idempotency-Key, quota-capped (ADR-0028)
• BYOK — allowlisted providers w/ fixed base URLs (SSRF closed by construction), AES-256-GCM envelope encryption with versioned KEK, production boot guard, request-count quotas (ADR-0027)
• Account lifecycle — suspension with honest auth codes, deletion with full PII scrub (including encrypted learning briefs), last-admin invariant
• Streaming observability — real token usage recorded per streamed tutor turn; failures land on the failure path, BYOK credentials invalidated on yielded auth errors

Breaking changes

• Roles collapsed: student/instructor → user (phased zero-downtime migration; all existing content preserved)
• publish no longer lists a course publicly — public listing requires share + admin approval
• RequireInstructor removed; URL ingest is admin-only + flag-gated

Verification

Built as a gated waterfall (6 ADRs, 7 streams), every stream cleared a Codex challenge, an independent reviewer pass, and a live in-browser walk. At release: backend 1465 / frontend 469 tests, WCAG 2.2 AA axe gate (0 violations), en+ar i18n parity, Playwright E2E on Chromium + WebKit, and the complete story verified end-to-end on production with the real LLM.

Full details: CHANGELOG · Live demo · Public evals

What's Changed

• Lumen 1.1.0-agentic: portfolio activation (Wave 1+2 + screencast + MCP publish) by @ahmedEid1 in #6
• feat(eval): add ingest n=10 Groq run + harness fixes are live by @ahmedEid1 in #7
• feat(embeddings): Cloudflare Workers AI for retrieval — tutor eval 2.0→2.33/5 by @ahmedEid1 in #8
• chore(repo): delete legacy/ + tighten stale state (4 review rounds, both reviewers green) by @ahmedEid1 in #9
• chore: post-deploy tighten — live URL plumbing + 5 KIs closed + AWS Terraform into Rewrite by @ahmedEid1 in #10
• Add honest-numbers framing banner to /eval by @ahmedEid1 in #11

Full Changelog: https://github.com/ahmedEid1/lumen/commits/v2.0.0