Scholiq — Applied Specifications
All 6 Wave-2 compliance-audit wedge specs have been applied. Specs live in openspec/changes/ and were driven by the Hydra OpenSpec workflow.
1. nextcloud-app
Path: openspec/changes/nextcloud-app/
Status: Applied
Summary: Foundation spec that ships the standards-compliant Nextcloud app shell before any other capability can land. Delivers: appinfo/info.xml with hard dependencies on OpenRegister and OpenConnector; lib/AppInfo/Application.php registering all services and listeners; the Vue 2 SPA entry point (src/main.js); the admin and user settings panels; src/manifest.json adopting CnAppRoot Tier 4 (ADR-024); l10n/nl.js and l10n/en.js i18n stubs. All downstream specs (course-management, enrolment, certification, compliance-audit, dashboard) depend on this foundation.
2. course-management
Path: openspec/changes/course-management/
Status: Applied
Summary: Adds the Course and Lesson schemas (the data layer all other wedge specs operate on), plus the XapiStatement schema for the built-in LRS substrate. Implements the cmi5 JWT launch protocol via Cmi5LaunchTokenService (legitimate PHP — cryptographic operation). Introduces CoursePublishGuard enforcing that at least one published Lesson must exist before a Course can publish. Content types supported: text, video, scorm12, scorm2004, cmi5, lti, quiz. Course lifecycle: draft → published → archived; Lesson lifecycle: draft → published → retired. Aggregations on Course expose enrolledLearners and completedLearners counts.
3. enrolment
Path: openspec/changes/enrolment/
Status: Applied
Summary: Adds the Enrolment schema linking learner identities to courses with mandatory-training and due-date tracking. Lifecycle: pending → active → completed | withdrawn | failed. Declarative calculations provide isOverdue, daysRemaining, and ragStatus (RAG traffic-light). Declarative notifications deliver T-30/T-7/T-1 due-date reminders (idempotency-keyed), welcome and completion confirmations, and overdue alerts to the learner's manager (HR-group fallback). Bulk enrolment is handled by posting to OR's batch endpoint from BulkEnrolModal — no BulkEnrolmentService PHP class. The myMandatoryTraining widget declaration on the Enrolment schema powers the Learner Home dashboard.
4. certification
Path: openspec/changes/certification/
Status: Applied
Summary: Adds the Credential schema for Open Badges 3.0 verifiable credentials, append-only per ADR-008. Credential issuance is guarded by CredentialSigningService (legitimate PHP — RS256 cryptographic operation) which builds the OB3 JSON-LD assertion and signs it with the tenant's RSA private key. The CredentialIssuanceHandler listener bridges the Enrolment completed event to the Credential issue transition. Lifecycle: issued → revoked | expired. Calculated fields provide daysUntilExpiry, expiryStatus, and boolean flags (isExpiringIn90Days, isExpiringIn30Days, isExpired) that drive tiered notifications. A public unauthenticated verification endpoint (CredentialVerifyController) is declared. RSA key management is handled by KeyManagementService + KeyAdminController.
5. compliance-audit
Path: openspec/changes/compliance-audit/
Status: Applied
Summary: The primary purchaser-facing deliverable of Wave 2. Adds the Regulation schema (coverage tracking framework) and the Attestation schema (append-only HMAC-signed evidence per ADR-008). Regulation aggregations perform live cross-schema joins over Enrolment/Attestation/Credential via regulationSlug to compute coveragePercent and ragStatus. The officerAlertOnCoverageDrop notification uses OR's calculatedChange trigger to alert compliance officers when coverage drops to red — no background job. AttestationSigningGuard validates cmi5 xAPI completion records and computes HMAC-SHA256 signatures at the drafted → signed transition. AuditPackExportController streams the ADR-008 §6 audit-pack ZIP (ndjson + csv + manifest + signature-verification instructions). Regulation widgets (coverageGrid, boardProof, attestationCount) are declared on the schema and referenced from the Compliance dashboard page.
6. dashboard
Path: openspec/changes/dashboard/
Status: Applied
Summary: Wires the manifest pages for role-appropriate dashboards: the Compliance dashboard (Regulations coverage grid + attestation count), the Learner Home (mandatory training task list), and the AdminHealth dashboard (observability stats via HealthController). The intended role-aware visibleIf page gating is designed but not yet supported by nc-vue manifest schema v1.4.0 — pages currently declare conformant-but-minimal {id, title, type:custom} widgets and the role routing is a follow-up tracked in nc-vue umbrella #200. All schema widget declarations (myMandatoryTraining, coverageGrid, boardProof, attestationCount) are present in the register and will be used once the manifest schema adds widget-ref support.