update memory bank

memory-bank/activeContext.md

@@ -1,9 +1,9 @@
 # Active Context
 
 ## Current Focus
-- 2026-04-04: Commit and checkpoint the new exam module after backend/runtime verification.
-- 2026-04-04: Keep the memory bank aligned with the new final-exam architecture, certification rule, and Docker-based verification workflow.
+- 2026-04-04: Keep the memory bank aligned with the new final-exam architecture, simplified CI workflow set, and Docker-based verification workflow.
 - 2026-04-04: Preserve the remaining manual browser QA gap for the exam UI and course integration views.
+- 2026-04-04: Review drag-and-drop learner interaction for remaining UI/UX friction after the one-at-a-time and touch-friendly changes.
 
 ## Recent Changes
 - 2026-03-18: Reviewed repository docs, packaging files, hooks, auth layer, SPA router, frontend bootstrap, and test/CI surface.
@@ -24,16 +24,18 @@
 - 2026-04-04: Added prerequisite evaluation for course progress, selected quizzes, and selected drag-and-drop activities with AND-only semantics and `Attempted` / `Passed` requirement modes.
 - 2026-04-04: Live-verified the exam module inside the running `frappe` container with `bench migrate`, course detail/outline payload checks, a successful smoke exam submission path, member-specific prerequisite status checks, and certification gating checks.
 - 2026-04-04: Fixed stale exam output during live verification by replacing cached exam loads with uncached `frappe.get_doc` calls in exam status helpers.
+- 2026-04-04: Simplified the GitHub Actions footprint so PR validation centers on `ci.yml` and `linters.yml`, release images build from tags in `build.yml`, and UI tests are manual-only for now.
+- 2026-04-04: Removed the local-repo Codecov upload path from `ci.yml`; coverage can still be generated without relying on a Codecov integration.
+- 2026-04-04: Fixed the remaining local quality gates for the exam branch: Semgrep-reviewed guest endpoint suppressions are formatted cleanly, `pre_commit --all-files` passes in the `frappe` container, and container `yarn build` succeeds after moving problematic mobile lesson actions into named handlers.
 
 ## Next Actions
 - Run a manual browser pass for the new exam UI on `/lms/exams`, `/lms/exams/:examID`, `/lms/exam/:examID`, and the course overview/outline exam surfaces.
 - Decide whether to add editor-side chapter actions for attaching exams or keep chapter placement solely on the exam form for now.
 - Continue frontend verification from the parent compose project using `docker compose exec frappe ...` instead of host-shell builds.
-- Monitor GitHub Actions release runs to confirm the new `FRAPPE_REF` / `PAYMENTS_REF` validation produces clear failures when refs are wrong and that successful builds keep pushing to GHCR.
+- Review drag-and-drop learner interaction for remaining friction in answer-bank focus, mobile paging, and step-by-step progression.
 - Revisit the remaining Node 20 deprecation warning only when Docker publishes Node 24-ready action runtimes or when a test branch is ready to opt into forced Node 24 execution.
 
 ## Blockers
 - Host-shell frontend validation is misleading in this workspace because the app is meant to run inside Docker.
-- Container-side frontend validation currently hangs in `vite build` when run as `docker compose exec frappe bash -lc 'cd /home/frappe/frappe-bench/apps/lms/frontend && yarn build'`.
 - Remaining Node 20 deprecation warnings cannot be fully removed from the build workflow until Docker updates the affected GitHub Actions runtimes upstream.
 - Playwright/browser automation is not available in this session, so exam verification is currently limited to Docker + Bench runtime checks plus any manual browser QA the user performs.

memory-bank/productContext.md

@@ -21,6 +21,7 @@
 - 2026-03-29: Drag and drop assessment flows should avoid overwhelming learners; the current UX direction is one prompt at a time with Previous/Next navigation.
 - 2026-04-04: Final exams should feel like a first-class assessment type with a standalone authoring/library flow, a learner-facing locked/unlocked state, and prerequisite explanations that tell learners exactly what is missing.
 - 2026-04-04: If a course has a final exam, learners should still be able to reach normal 100% course progress while clearly seeing that certification remains blocked until the final exam is passed.
+- 2026-04-04: Public course browsing should remain guest-accessible, but final-exam metadata and placement should only be enriched for authenticated learners so public discovery stays lightweight and safer.
 
 ## Acceptance Signals
 - Public course browsing, enrollment, and lesson consumption are available from website routes under the LMS base path.

memory-bank/progress.md

@@ -22,17 +22,20 @@
 - 2026-04-04: Added certification gating so courses with a final exam require an exam pass before certificate issuance.
 - 2026-04-04: Live-verified exam migrations, course detail/outline payloads, smoke submission, learner-specific prerequisite status, and final-exam certification blocking inside the running Dockerized Frappe site.
 - 2026-04-04: Fixed stale exam status rendering by removing cached exam document reads from the live exam aggregation path.
+- 2026-04-04: Simplified GitHub Actions around this fork's current needs by keeping PR lint/tests, tag-based builds, manual UI tests, and removing unused repo-local release automation workflows.
+- 2026-04-04: Removed the unused Codecov upload job from `ci.yml`; coverage generation remains possible without a Codecov integration.
+- 2026-04-04: Kept public course detail/outline endpoints guest-accessible while stripping final-exam enrichment for guests and documenting the reviewed exception with `nosemgrep` suppressions.
+- 2026-04-04: Brought the local quality gates back to green: `python3 -m pre_commit run --all-files` passes inside the `frappe` container, and container-side `yarn build` now succeeds after fixing the exam import and lesson mobile action handlers.
 
 ## In Progress
 - Manual browser verification for the exam module is still pending because only Docker + Bench runtime verification was completed in this session.
-- Frontend verification for the drag and drop refresh is still in progress because the containerized `yarn build` does not complete after entering the Vite transform/build phase.
 - Workflow observation is still in progress for the remaining Node 20 deprecation warning emitted by Docker-maintained GitHub Actions.
+- Drag-and-drop learner UI/UX review is in progress to identify the next round of interaction improvements.
 
 ## Todo
 - Keep the memory bank current as future feature work, fixes, and design decisions land.
 - Add deeper historical notes when specific subsystems are modified or reviewed in detail.
 - Run a browser-level exam QA pass covering authoring, learner lock states, unlocked attempts, course outline placement, and certificate button behavior.
-- Diagnose why `docker compose exec frappe bash -lc 'cd /home/frappe/frappe-bench/apps/lms/frontend && yarn build'` hangs during `vite build`.
 - Review whether the remaining PR semantic action should also be pinned or replaced with a more stable dependency reference.
 - Run targeted app-level tests or manual QA for drag and drop sidebar access, mobile/touch placement, and stepped item navigation once the local/container runtime is ready.
 - Revisit Docker GitHub Actions versions when upstream publishes Node 24-ready runtime updates.
@@ -42,7 +45,6 @@
 - Route, auth, and guest-access behavior can regress if server rules and SPA assumptions diverge.
 - Existing memory bank content can go stale quickly unless updated after each substantial task.
 - Host-only frontend tooling can mislead verification because the canonical runtime in this workspace is the Dockerized `frappe` container.
-- Long-running or stuck container builds can leave background `vite build` processes behind if verification attempts are not cleaned up.
 - Some release jobs may still reveal hidden permission gaps once they run against GitHub, especially where branch pushes, PR creation, or release mutation depend on repository settings beyond workflow YAML.
 - The remaining Docker-action Node 20 warnings can create alert fatigue even though the build currently succeeds, and they depend on upstream action runtime updates rather than repo-local YAML alone.
 - The new exam feature crosses assessments, course aggregation, and certification logic, so regressions can appear in user flows that are not obviously “exam” screens.

memory-bank/projectbrief.md

@@ -20,5 +20,6 @@
 - In scope: courses, lessons, batches, quizzes, assignments, programming exercises, certificates, payments, profiles, badges, jobs, programs, search, and statistics.
 - 2026-03-29: Drag and drop activities are now an actively extended assessment surface, including colorful answer banks, mixed text/image prompts, mobile-friendly tap placement, and one-item-at-a-time navigation.
 - 2026-04-04: Final exams are now an in-scope assessment surface. They are modeled separately from quizzes, belong to a course, can be displayed under a chosen chapter, and can gate certification without changing normal course progress.
+- 2026-04-04: This fork's contributor workflow is intentionally simpler for now: PRs focus on linting and tests, tagged releases build/push images, and nonessential repo-local release automation remains removed until it is needed again.
 - In scope: website delivery under a configurable LMS base path and a Vue SPA mounted inside Frappe.
 - Out of scope: native mobile clients and multi-service deployment orchestration in this repo.

memory-bank/systemPatterns.md

@@ -35,3 +35,5 @@
 - 2026-04-04: Model the final exam as a course-level DocType instead of overloading lesson resources or quizzes. Rationale: the exam needs independent prerequisite logic, certification gating, attempt handling, and future exam-only metadata. Impact: exam state now spans dedicated DocTypes, course detail/outline aggregation, and certificate eligibility rules.
 - 2026-04-04: Keep final exams outside normal course progress while making them mandatory for certification when present. Rationale: product wants progress to reach 100% before the exam while still treating the exam as a final gate. Impact: prerequisite checks use normal course progress, and certificate validation now performs an additional exam-pass check.
 - 2026-04-04: Use `frappe.get_doc` instead of `frappe.get_cached_doc` when assembling live exam status for course payloads. Rationale: cached exam docs caused stale `display_chapter` and status output during live verification. Impact: course outline/detail responses now reflect exam edits immediately.
+- 2026-04-04: Keep guest-whitelisted course endpoints for public browsing, but strip final-exam enrichment for guests and document the intentional exception with reviewed `nosemgrep` comments. Rationale: the product needs public course pages while Semgrep requires explicit review of guest-exposed methods. Impact: guest course detail/outline payloads stay public, but exam metadata is only added for authenticated users.
+- 2026-04-04: Refactor template actions into named handlers when inline Vue expressions fight Prettier or the Vite parser. Rationale: the mobile lesson action buttons were stuck in a formatter/build conflict. Impact: local `pre_commit --all-files` and container `yarn build` are now both reliable gates.

memory-bank/techContext.md

@@ -14,6 +14,7 @@
 - Frontend dev server uses Vite with a local `frappe-ui` checkout when available, otherwise the npm package fallback.
 - 2026-03-29: Container image builds are driven by `.github/workflows/build.yml` and now use `FRAPPE_REF` and `PAYMENTS_REF` repository variables, with backward compatibility for the older `FRAPPE_BRANCH` variable.
 - 2026-04-04: Live app verification for new DocTypes is currently most reliable through `docker compose exec frappe ...` with Bench commands against `lms.localhost`; direct host-shell Frappe/Python checks are less trustworthy in this workspace.
+- 2026-04-04: The active GitHub workflow set is intentionally small: `build.yml`, `ci.yml`, `linters.yml`, `release_notes.yml`, and `ui-tests.yml`. This fork does not currently maintain a Codecov upload path.
 
 ## Constraints
 - The repo mixes Python, Frappe metadata, Vue, Cypress, and generated assets, so changes often need cross-layer validation.
@@ -23,6 +24,7 @@
 - Docker-backed verification may be more reliable than host-shell verification because node/yarn availability and dependency state differ between the host and the running `frappe` container.
 - 2026-03-29: GitHub Actions build warnings about Node 20 deprecation still remain for the Docker-maintained actions (`docker/build-push-action`, `docker/login-action`, `docker/setup-buildx-action`, `docker/setup-qemu-action`) even after local workflow upgrades; this is currently an upstream action-runtime issue, not a repo-specific misconfiguration.
 - 2026-04-04: Ad hoc Python inside the `frappe` container may need explicit `sites_path` and writable log directories (`/home/frappe/logs`, `/home/frappe/frappe-bench/sites/<site>/logs`) if run outside normal Bench helpers during deep verification.
+- 2026-04-04: Local workflow reproduction should prefer the container. `python3 -m pre_commit run --all-files` and `yarn build` are both currently green inside the `frappe` service, while host-shell results can be misleading.
 
 ## Key Commands
 - `bench start`
@@ -32,6 +34,7 @@
 - `yarn test-local`
 - `ruff check .`
 - `docker compose exec frappe bash -lc 'cd /home/frappe/frappe-bench/apps/lms/frontend && yarn build'`
+- `docker compose exec frappe bash -lc 'cd /home/frappe/frappe-bench/apps/lms && python3 -m pre_commit run --show-diff-on-failure --color=always --all-files'`
 - `docker compose exec frappe bash -lc 'cd /home/frappe/frappe-bench && bench --site lms.localhost migrate'`
 - `docker compose exec frappe bash -lc 'cd /home/frappe/frappe-bench && bench --site lms.localhost execute <python.path> --kwargs \"{...}\"'`
 - `git ls-remote --heads https://github.com/frappe/frappe <ref>`