Progress has to be earned by evidence.

Readiness boundaries

• Game rewards and streaks never feed the readiness projector.
• Reading a guide or writing a lab reflection does not increase correctness.
• Scored observations retain content version and server-derived taxonomy attribution so projections can be rebuilt and audited.
• Low evidence is shown as insufficient evidence, not confident mastery.

Account and data controls

Learner rows are protected by database row-level security. Completion actions are idempotent and transactional, and export/deletion cover the registered learner-data inventory. Privileged maintenance and content actions are separately authenticated.

Tutor guardrails

The tutor is grounded in server-loaded study sources, reconciles citations to retrieved material, marks missing coverage as uncertain, refuses prohibited exam-dump requests, and cannot change a study plan without explicit learner confirmation. Provider calls have per-request, daily, monthly, and global cost ceilings.

What is still limited

This is a small, allowlisted private beta. Platform logs are the only live operational signal, no managed database backup is configured, and Kubernetes browser terminals remain preview-only. Managed observability, custom SMTP, backups, restore rehearsal, and human accessibility review are gates for external beta.