Classroom follow-on: Protected staged case assets and rich Student case rendering #316

Roadmap status — ACTIVE NEXT SLICE

Pre-production hardening #328 → #329 → #330 is complete and production-published. #316 is now the active Classroom implementation slice, followed by #317.

Canonical planning contract: docs/preproduction-hardening.md.

Deployment prerequisite — satisfied

#321 / PR #322 is complete. Exact merged-main commit 21bff1d1c5a70caff0aa94aadd58abcb0644f397 reached Vercel production READY, with 5/12 conservative Serverless Function candidates and a clean post-deploy runtime-error scan. #316 is now unblocked and is the immediate next Classroom implementation issue.

Goal

Make the staged Classroom engine capable of presenting real protected KT Case Study material, not only synthetic text blocks.

#313 deliberately added schema support for Student content kinds narrative, prompt, evidence, image, table, and document-page, but the current Student case-reference client sanitizes/renderers released content as id/kind/title/body only. As a result, production images, document pages, and structured tables are not yet usable even though the authoring schema accepts them.

Required work

• add a server-only protected asset registry keyed by stable assetId;
• define Instructor/Student authorization for asset retrieval using the represented staged exercise and current cumulative release;
• never expose protected asset URLs/paths in public static assets or unreleased Student payloads;
• render released Student table blocks accessibly;
• render released Student image blocks with reviewed alt text;
• render document-page blocks in a protected, readable form suitable for case pages/evidence;
• keep future-stage assets server-gated, not DOM-hidden;
• preserve no-store/no-referrer behavior and the existing Vercel dist/ public boundary;
• add unit/API/browser tests for authorized current-stage access, unreleased/future denial, cross-class denial, mobile layout, keyboard use, and serious/critical axe checks;
• update staged-simulation authoring docs and cold-start guidance.

Security invariants

• stable Student class-session authority may retrieve only content already authorized by the current staged release;
• workspace edit capabilities do not independently authorize case assets;
• Instructor authority is class-scoped;
• raw authored files must not become public Vercel assets;
• asset access must not reveal whether another class/stage owns an unreleased asset.

Done when

A production staged case can safely show source-faithful text, tables, images, and document pages in the Student case-reference without shipping unreleased/protected material to the browser.

Relationship

Follow-on to #313 / PR #315. This is the first blocker before authoring a real production staged Case Study.