Sapiqo LMS 1.13.1

Administrator and course-author previews now open every lesson, including later modules, without requiring learner enrollment or recording completion. Learners keep their paid-course, draft and lesson-order restrictions.

The runtime reader is bundled inside the signed code update and its URL is versioned, so refreshing an existing course tab receives the fix. Shared reader assets remain available for standalone exports.

Validation: PHP security/HTTP regressions, author-versus-learner browser checks, upgrade/rollback and signature/tamper tests passed locally. The complete Verify workflow and Pages deployment passed for commit 9bf173c. This project is self-hosted; GitHub Pages serves the project introduction.

Use the full source ZIP for a fresh installation, or the trusted signed update package for an existing compatible deployment. Back up instance configuration, databases and course content before upgrading. No default administrator credentials are included.

Sapiqo LMS 1.13.0

Sapiqo LMS 1.13.0 verification

© 2026 Miguel Guhlin · CC BY-SA 4.0 · September 30, 2026

This implements the first substantial delivery across the planned roadmap.
It does not claim the real-provider, independent accessibility or
organizational-pilot acceptance criteria have been completed. Users supply their
own host; the local demo uses SQLite and MariaDB is an optional configured backend.

Delivered

• Complete database/data/course backups, integrity checks before restore writes,
  relocation with custom SQLite paths and --keep-config, private MySQL options.
• TOTP MFA, encrypted persistent secrets, one-use recovery codes, replay
  protection, global session revocation, password-change revocation and verified
  SSO linking. Additional and original provider identities cannot be stolen.
• Scoped API keys; new keys default to course read. Existing keys retain legacy
  access until rotated, with a visible notice.
• Trusted generated reader shells and an opaque-origin sandboxed SCORM player
  with a bounded, source/channel-validated completion bridge.
• Readiness guide, three course templates, publication checks and next activity.
• Text/file assignment drafts and resubmissions, reusable rubrics, instructor
  feedback, gradebook integration and required-assignment certificate gating.
• Explicit course instructor grants; content developers cannot read student
  submissions merely because they can author content. Attachments are private.
• UTC-normalized cohort schedules, late policies, daily deadline reminders and
  actionable incomplete-learning reports.
• Focused account, learning and assignment services/routes; no wholesale rewrite.
• SMTP header injection rejection and a MariaDB quiz-locking fix found by stress
  tests during this work.

Executed locally

• 84 security regression checks and 39 real HTTP checks.
• Database/course backup restore, custom SQLite relocation and tampered backup
  rejection before destination writes.
• Eight independent PHP workers contest each reset token, quiz limit,
  authenticator code and assignment revision: exactly one success on SQLite and
  MariaDB.
• Disposable MariaDB 11.8.6: schema, assignment grading/completion, dump/restore.
• Chromium: desktop/mobile roadmap, mobile account/assignment screens, author →
  learner → grade → certificate, private workflow boundaries, sandboxed SCORM
  parent access denial, MFA challenge/recovery and session revocation.
• Local SMTP protocol/header/dot-stuffing fixture; no email sent externally.
• Real 1.12.1 code upgraded to 1.13.0 in a temporary installation, migrated to
  schema 22, then code rolled back; users, configuration and courses preserved.
• PHP syntax, shipped JavaScript syntax, shell syntax and Python checks.

GitHub Actions passed all six jobs: PHP 8.1/8.3/8.4 regression, Chromium,
MariaDB, and Docker/Apache build/first-login/readiness.
Verified run
at commit 0285f0a5326c5e8cc4ffd7fc6169affea803b8e9.

Download the source ZIP for a new local SQLite or self-hosted MariaDB
installation. The update TAR.GZ replaces LMS code only; update shared
content/assets from the source ZIP as described in Operations. Verify downloads
against SHA256SUMS. Back up before upgrading an existing installation.

Material limits

Read Operations, Compatibility and the
Pilot protocol. In particular: SCORM's basic shim does not
implement full sequencing/suspend-data/network support; imported custom root
shell scripts are replaced; shared reader assets require updating with the
release; file-by-file updates are not atomic; MFA is opt-in; attachments are not
antivirus-scanned; users operate their own PHP installation.
Real SSO/LTI credentials, SMTP TLS delivery, assistive-technology review,
representative package round trips and organizational pilots remain unverified.

Sapiqo LMS 1.12.1

Initial public release of Sapiqo LMS, a self-hosted PHP learning management system by Miguel Guhlin.

• Visual and Markdown course authoring, assessments, forums, groups, badges, certificates, transcripts, and integrations.
• Security fixes for scoped managers, course access, progress and grading, CSRF, SSO/LTI identity handling, archives, backups, and installers.
• 58 security regression checks, 25 HTTP checks, backup/restore validation, and desktop/mobile browser verification.
• Project README, English/Spanish manuals, an audit report, CI, and a GitHub Pages introduction.

Website: https://mguhlin.github.io/sapiqolms/

License: Original project material © 2026 Miguel Guhlin, CC BY-SA 4.0. Bundled fonts retain their original licenses.

Download the attached source ZIP and follow installer/README.md. GitHub Pages hosts the introduction; the LMS requires a PHP server or Docker.

Before operating a production installation, review SECURITY.md and docs/CODE_AUDIT.md, including integration compatibility and test coverage limitations. SSO does not automatically link existing local accounts by email; LTI identities are separate learner accounts.