feat: Sprints 24-26 — RBAC, Sign Languages, Skills, Braille, Make the Invisible Visible by rafaelob · Pull Request #1 · rafaelob/aiLine

rafaelob · 2026-02-16T22:35:40Z

Summary

Comprehensive delivery of Sprints 24-26, covering RBAC authentication, international sign languages, Skills DB persistence, Braille translation, and the "Make the Invisible Visible" frontend sprint that exposes AiLine's 5-agent AI pipeline to users and hackathon judges.

Sprint 24 — International Sign Languages & RBAC Login

8 international sign languages (ASL, BSL, LGP, DGS, LSF, LSE, Libras, ISL) with registry, discovery API, and gloss translator
RBAC system: 5 roles (super_admin, school_admin, teacher, student, parent), JWT auth, 5 ORM tables, migration 0003, middleware, authorization module
Auth API: POST /auth/login, POST /auth/register, GET /auth/me, GET /auth/roles
Frontend: Login page with role selection, auth store (Zustand), sign language selector, auth headers priority chain
Mega Review: 5 CRITICAL/HIGH security fixes (auth bypass, race condition, JWT hardening), accessibility audit (7 fixes, 51 tests)

Sprint 25 — Skills DB + Braille Phase 1

Skills DB Persistence (F-175): Skill/SkillVersion/SkillRating/TeacherSkillSet models with pgvector embeddings (1536d HNSW), migration 0004, SkillRepository port + PostgresSkillRepository + FakeSkillRepository adapters, 50 tests
Braille Phase 1 (F-166): BrfTranslator Grade 1, NABCC mapping, EN/PT-BR/ES, 40-cell line wrap, pagination, 40 tests

Sprint 26 — "Make the Invisible Visible"

Skills API (F-176): 9 endpoints under /v1/skills wired with SessionFactorySkillRepository
TTS Integration (F-165): ElevenLabs adapter, POST /media/tts/synthesize + GET /voices, FakeTTS fallback
Skills Workflow (F-177): skills_node integrated in plan + tutor LangGraph workflows
Pipeline Visualization (F-217): 6-node real-time CSS Grid graph with "Opus 4.6 Core" badge, SSE-driven state transitions
Adaptation Diff View (F-218): Split-pane standard vs AI-adapted curriculum with 4 profile tabs and diff highlighting
Evidence Panel (F-219): 6-section trust accordion (model, quality score gauge, standards, RAG provenance, accommodations, processing time)
TTS Audio Player (F-220): Play/pause, speed selector (0.5x-2x), language/voice selectors, progress bar
Braille Download + Copy (F-221): Download .brf file + copy to clipboard on BraillePreview component
Inclusive Classroom Mode (F-222): "One Lesson, Four Adapted Plans" 2x2 teacher cockpit grid

Quality

15 ruff lint errors fixed across 8 backend files
2 TypeScript errors fixed (FeatureItem icon type, ReactNode cast)
ai_receipt SSE event type mismatch fixed
evidence-panel null-safety fixes
Docker frontend memory increased to 2G

Test Results (Docker Compose)

Suite	Result
Backend (runtime)	2,348 passed, 3 skipped
Agents	277 passed
Frontend	1,236 passed (135/136 test files)
Total	~3,861 tests

Expert Consultations

GPT-5.2: Backend architecture review, code review (62 issues), strategic analysis
Gemini-3.1-Pro: UX design for all 5 frontend components, accessibility patterns

Test plan

Docker Compose: all 4 services healthy (db, redis, api, frontend)
Backend tests: docker compose exec api python -m pytest tests/ -x -q — 2,348 passed
Frontend tests: docker compose exec frontend pnpm test — 1,236 passed
API endpoints verified: /health, /v1/skills, /media/tts, /auth/roles, /sign-language/languages
0 ruff lint errors, 0 mypy type errors
Control docs synced (CHANGELOG, FEATURES, SYSTEM_DESIGN, TODO)

🤖 Generated with Claude Code

- Observability dashboard: fix double URL prefix, add auth headers, add AbortController to prevent polling overlap on unmount - Landing cards: replace useInView+animate with whileInView for reliable scroll-triggered animations - Landing sections: reduce excessive vertical padding - Badge contrast: increase font size to 11px + add drop-shadow for WCAG compliance on gradient backgrounds - PWA install banner: reposition to bottom-left to avoid overlap - Manifest: set start_url and lang to English (default locale) - i18n: add nav.accessibility key, fix captioning_description - Dashboard page test: mock PageTransition to fix class assertions - Stats padding: responsive py-8/md:py-12 Reviewed by GPT-5.2 (backend/arch) and Gemini-3-Pro (frontend/UX). All 1115 frontend tests + 13 observability tests passing. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Copilot

Pull request overview

This PR addresses 10 UX, accessibility, and technical issues identified in an expert review. The changes span frontend components, backend API responses, internationalization, and PWA configuration to improve user experience, accessibility compliance, and code reliability.

Changes:

Fixed triple bug in observability dashboard (double URL prefix, missing auth, AbortController for polling cleanup)
Refactored landing page animations from useInView hook to whileInView prop pattern for reliable scroll-triggered animations
Enhanced accessibility with improved badge contrast (WCAG AA compliance) and repositioned PWA install banner to avoid FAB overlap
Updated PWA manifest and i18n keys from Portuguese to English as default locale
Added flat fields to observability API response matching frontend TypeScript interface

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
`runtime/ailine_runtime/api/routers/observability.py`	Added flat fields to dashboard response for frontend interface compatibility; maintained backward-compatible nested structure
`runtime/tests/test_observability_api.py`	Added test assertions for new flat field structure in observability dashboard response
`frontend/src/components/observability/observability-dashboard.tsx`	Fixed URL prefix bug, added auth headers, implemented AbortController for polling cleanup
`frontend/src/components/landing/landing-how-it-works.tsx`	Refactored from useInView to whileInView pattern; reduced section padding
`frontend/src/components/landing/landing-features.tsx`	Applied whileInView pattern for scroll animations; reduced section padding
`frontend/src/components/landing/landing-demo-login.tsx`	Applied whileInView pattern; increased badge font size and added drop-shadow for WCAG compliance
`frontend/src/components/landing/landing-stats.tsx`	Made padding responsive (py-8 md:py-12) for better mobile/desktop balance
`frontend/src/components/pwa/install-prompt.tsx`	Repositioned to bottom-left to avoid overlapping Quick Actions FAB
`frontend/public/manifest.json`	Changed start_url and lang from pt-BR to en for English default
`frontend/src/messages/{en,es,pt-BR}.json`	Added nav.accessibility key; made captioning_description language-agnostic
`frontend/src/components/landing/*.test.tsx`	Updated test mocks to handle new whileInView and viewport props
`frontend/src/app/[locale]/(app)/dashboard/page.test.tsx`	Added PageTransition mock and updated test selectors

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

…ontend, backend ## Mega Review: 5 specialized agents + team lead ### Security (14 findings, 4 fixed) - AILINE_DEV_MODE default true→false in docker-compose (FINDING-2 HIGH) - X-Request-ID validation: regex max 128 chars, reject malformed (FINDING-4 HIGH) - /demo/reset changed from GET to POST (state mutation via GET) - run_id field validation: pattern + max_length on plan/stream schemas ### Accessibility (10 fixes) - record-progress-form: added <label> for all 4 inputs + select (WCAG 1.3.1) - landing-hero: i18n for ARIA labels (was hardcoded English) - landing-page: added skip-link + role="main" on <main> - not-found: changed <div> to <main role="main"> - error.tsx: conditional animations with useReducedMotion - demo-tooltip: type="button" + focus-visible outlines - pending-reviews-badge: descriptive aria-label - i18n: 7 new keys across en/pt-BR/es for ARIA labels ### Frontend (5 fixes) - PageTransition stagger prop was no-op (now wraps children) - TopBar dropdown: click-outside + Escape dismiss handlers - Dashboard hero: removed redundant nested entrance animations - TutorChat: removed no-op ternary in animation delay - Test setup: createElement instead of JSX in .ts file ### Backend (4 fixes) - Media uploads: Content-Length check before reading body - Tutor chat: module-level imports (was inline per-request) - Lint: fixed import ordering, unused import, f-string placeholder ### Test Infrastructure (11 failures → 0) - Global mock for next/link in setup.ts - PageTransition mock in dashboard + plans page tests - Sidebar test: motion.nav mock alignment ### Verification - Backend: 1938 passed, 0 failures - Frontend: 1115 passed, 0 failures - Lint (ruff + eslint): 0 errors - Typecheck (mypy + tsc): 0 errors - Docker: 4 services healthy Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Comprehensive quality audit by 7 specialized agents plus a first-run setup wizard for open-source deployments. ## Mega Review (7 agents, ~40 fixes) Security: - Add auth to /health/diagnostics (SEC-03) - Rate limiter trusted proxy validation for X-Forwarded-For (SEC-04) - PlanGenerateIn.user_prompt max_length=50000 (SEC-07) - Traces limit Query(ge=1, le=50) (SEC-15) - PlanReviewIn.status regex pattern validation Backend: - Thread-safe singleton getters (review_store, progress_store, trace_store, observability_store, rag_diagnostics_store) - Tenant context path exclusion: exact-match /health, prefix-based /health/ready, /setup, /metrics, /demo, /docs Frontend: - 9 i18n fixes: hardcoded strings → translation keys (sidebar, command palette, progress dashboard/heatmap, demo login, dashboard content) - 95 new i18n keys across EN, PT-BR, ES Infrastructure: - Redis healthcheck: REDISCLI_AUTH env var instead of CLI arg - DB healthcheck: use $$POSTGRES_USER/$$POSTGRES_DB env refs - CI: --frozen-lockfile on all pnpm install, uv cache enabled - Frontend Dockerfile: healthcheck alignment (wget --spider) - .env.example: document missing variables Agents: - Skills loader error handling improvements - Skills registry thread safety - Scorecard node robustness ## Setup Wizard (new feature) Backend API (runtime/ailine_runtime/api/routers/setup.py): - GET /setup/status — check if setup is complete - GET /setup/defaults — available providers, models, locales - POST /setup/validate — API key format validation - POST /setup/apply — generate .env file from wizard config - Embedding dimensions locked after first setup (HTTP 409) Frontend wizard (7-step stepper at /[locale]/setup): 1. Welcome & Language 2. AI Provider + key validation 3. Embeddings (permanent lock-in warning) 4. Agent Models (planner, executor, QG, tutor) 5. Infrastructure (DB, Redis, ports) 6. Security & Media (JWT auto-gen, CORS, ElevenLabs) 7. Review & Apply Other: - Default embedding dimensions 1536 → 3072 (gemini-embedding-001) - setup_complete field added to Settings Verified: 1938 backend + 287 agents + 1115 frontend tests passing, ruff/mypy/eslint/tsc all clean, Docker Compose 4 services healthy. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…, Docker 7-agent parallel audit covering security (OWASP), architecture, WCAG 2.2 AA accessibility, backend patterns, frontend quality, test suite, and sprint retrospective (sprints 14-23). Expert consultations with GPT-5.2 (backend) and Gemini-3-Pro (frontend/UX). Security (17 fixes): - Setup wizard: one-time token auth via X-Setup-Token header - Demo endpoints: require AILINE_DEMO_MODE=1 for mutating ops - HSTS preload + CSP frame-ancestors 'none' - DOMPurify FORBID_ATTR: ['style'] against CSS data exfiltration - Path traversal prevention: safe_path_component() in 3 filesystem stores - BaseRepository.get_by_id → get_by_id_unsafe (explicit tenant bypass) Backend (15 fixes): - structlog clear_contextvars erased tenant_id from middleware chain - ReviewStore thread-safety: lock on all read methods - _enforce_locked_fields was never called (embedding config protection) - GEMINI_API_KEY → GOOGLE_API_KEY env var in setup wizard - Public extract_teacher_id_from_jwt() wrapper for WebSocket endpoints - RAG diagnostics: Query validation on limit parameter Frontend (8 fixes): - Toast store timer leak: cancel auto-dismiss on manual removal - ExportPanel: prefers-reduced-motion support - ~50 pt-BR strings with missing diacritics - accessibility-store hydrate() with cssTheme mapping - Error page timeout cleanup on unmount Accessibility — WCAG 2.2 AA ~95% (18 fixes): - CSS theme mismatch: 3 personas silently failed (cssTheme mapping) - Focus trap in command-palette dialog - aria-live="polite" on toast provider - role="alertdialog" on install prompt (was banner) - role="radiogroup" on persona selectors - Visible labels, aria-busy, focus-visible outlines across forms - Missing i18n keys (submitting, plan_run) in 3 locales Docker: - Dockerfile: uv.lock constraints for reproducible agent deps resolution - Fixed pydantic-ai/anthropic version drift in Docker builds Evidence: 1,940 backend tests (Docker), 1,115 frontend tests, 0 lint/type errors, 4/4 Docker services healthy. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

… the Invisible Visible" Sprint 24: International Sign Languages & RBAC Login - 8 sign languages (ASL, BSL, LGP, DGS, LSF, LSE, Libras, ISL) with registry and discovery API - RBAC: 5 roles, JWT auth, domain entities, 5 ORM tables, migration 0003, middleware, authz module - Auth API: /auth/login, /register, /me, /roles - Frontend: login page, auth store, sign language selector, auth headers priority - Mega review: 5 CRITICAL/HIGH security fixes, accessibility audit (7 fixes, 51 tests) Sprint 25: Skills DB + Braille Phase 1 - Skills DB persistence: Skill/SkillVersion/SkillRating/TeacherSkillSet with pgvector, migration 0004 - Braille Phase 1: BrfTranslator Grade 1, NABCC mapping, EN/PT-BR/ES, 40-cell wrap Sprint 26: "Make the Invisible Visible" - Skills API wired to app factory with SessionFactorySkillRepository (F-176) - TTS router wired with ElevenLabs/FakeTTS fallback (F-165) - Skills workflow nodes in plan + tutor workflows (F-177) - Agent Pipeline Visualization: 6-node real-time CSS Grid graph (F-217) - Adaptation Diff View: split-pane standard vs adapted with profile tabs (F-218) - Evidence Panel: 6-section trust accordion with ai_receipt SSE (F-219) - TTS Audio Player: play/pause, speed/language/voice controls (F-220) - Braille Download + Copy on BraillePreview component (F-221) - Inclusive Classroom Mode: 2x2 teacher cockpit grid (F-222) Quality: 15 ruff lint fixes, 2 TS error fixes, ai_receipt SSE mismatch fix, evidence-panel null-safety, Docker frontend memory increased to 2G. Tests: 2,348 runtime + 277 agents + 1,236 frontend = ~3,861 tests passing. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Copilot · 2026-02-19T20:36:17Z

@rafaelob I've opened a new pull request, #3, to work on those changes. Once the pull request is ready, I'll request review from you.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings February 16, 2026 22:35

Copilot started reviewing on behalf of rafaelob February 16, 2026 22:36 View session

Copilot AI reviewed Feb 16, 2026

View reviewed changes

Comment thread runtime/ailine_runtime/api/routers/observability.py Outdated

rafaelob and others added 4 commits February 16, 2026 22:43

rafaelob changed the title ~~fix: resolve 10 UX/a11y/security issues from expert review~~ feat: Sprints 24-26 — RBAC, Sign Languages, Skills, Braille, Make the Invisible Visible Feb 19, 2026

This was referenced Feb 19, 2026

Fix quality_avg to average final_score instead of computing completion rate #2

Closed

Fix quality_avg to compute mean final_score instead of completion rate #3

Closed

Repository owner deleted a comment from Copilot AI Feb 19, 2026

Update runtime/ailine_runtime/api/routers/observability.py

9cf6c75

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

rafaelob merged commit 6d22aaf into main Feb 19, 2026
2 of 8 checks passed

rafaelob deleted the improvements branch February 19, 2026 20:59

Navigation Menu

Uh oh!

feat: Sprints 24-26 — RBAC, Sign Languages, Skills, Braille, Make the Invisible Visible - #1

feat: Sprints 24-26 — RBAC, Sign Languages, Skills, Braille, Make the Invisible Visible#1
rafaelob merged 6 commits into
mainfrom
improvements

rafaelob commented Feb 16, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI commented Feb 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

rafaelob commented Feb 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Sprint 24 — International Sign Languages & RBAC Login

Sprint 25 — Skills DB + Braille Phase 1

Sprint 26 — "Make the Invisible Visible"

Quality

Test Results (Docker Compose)

Expert Consultations

Test plan

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI commented Feb 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

rafaelob commented Feb 16, 2026 •

edited

Loading