Press Ctrl/Cmd + P to print
or save as PDF

Operations, APIs, and Governance

10.1 Roles & Responsibilities (Registrar, Program Director, Course Owner, NSF Steward, Quality Board)

Registrar (R): Code stewardship (course/program), transcript authority, RPL decisions, appeals log, public registry & redirects.
Program Director (PD): Defines program structure, minimum accepted revs, capstone rubric; approves substitutions & pathway changes.
Course Owner (CO): Outcomes, content, assessments, artifacts, accessibility; issues release notes and rev bumps; fixes QA findings.
NSF Steward (NSF): Credential schemas (OB3/VC), DID/keys, status lists, on-chain anchoring (hash-only), license/SPDX governance.
Quality Board (QB): Independent audits (WCAG, psychometrics, standards mapping), item-bank reviews, postmortems on incidents.
Platform Eng (PE): APIs, OAI-PMH, linter/CI, telemetry, security controls, backups/DR.
Library/Repository (LIB): DOIs (Crossref/DataCite), JATS deposits, STAC/DCAT-AP catalogs.

RACI (high level): Codes (R-A / PD-C / CO-C), Programs (PD-A / R-C), Releases (CO-A / QB-C / PE-C), Credentials (NSF-A / R-C), Metadata & Repos (LIB-A / PE-C).

10.2 Governance Calendar & Approvals

  • Monthly: Catalog changes, minor releases, linter & WCAG reports (CO/R/QB).
  • Quarterly: Standards/competency remap; CPD tables; external reviewer panel (QB/PD).
  • Semiannual: Item-bank standard setting (Angoff/Bookmark) and psychometrics deep-dive (QB/CO).
  • Annual: Policy review (privacy, dual-use), key rotation, DR exercise, public quality report (NSF/QB/R/PE).
  • Approvals:
    • MAJOR rev: PD + QB + R sign-off.
    • Program restructure: PD + R + NSF (if credential impact).
    • Co-badging MoU: R + NSF + Legal.

10.3 REST APIs (/api/catalog/v1) & Versioning

Base: /api/catalog/v1 (JSON; UTC; RFC 3339 dates).

  • GET /courses/{code} → latest record; ?rev=YY.MM.P for specific.
  • GET /programs/{program_code} → program object with requires[] (min rev).
  • GET /transcripts/{learnerId} → completions (code+rev), statuses (Current/Grace/Renewal Due).
  • POST /verify → validate OB3/VC; returns signature & status verdict.
  • GET /search?q=…&stream=…&type=…&lang=… → catalog search (LRMI facets).
  • API versioning: additive fields within /v1; breaking changes → /v2. Deprecations announced ≥90 days before removal.

Example (course response, trimmed):

{
  "code": "FIN-MC-318",
  "rev": "25.09.1",
  "title": "Stress Testing with Macro & Climate Scenarios",
  "hours": 18,
  "ncu": 1.8,
  "standards": ["Basel","ISSB","SR 11-7"],
  "competencies": {"ESCO":["13-2099"],"SFIA":["ANL4"]},
  "status": "active"
}

10.4 Webhooks & Event Streams (Enroll, Issue, Revoke)

Outbound webhooks (signed, retry with backoff):

  • learner.enrolled, learner.completed, badge.issued, badge.revoked, program.conferral, artifact.published.
    Headers: X-Nexus-Signature: sha256=… (shared secret).
    Payload (badge.issued):
{
  "event": "badge.issued",
  "ts": "2025-09-09T15:20:01Z",
  "code": "FIN-MC-318",
  "rev": "25.09.1",
  "assertionId": "https://nexus.gcri.org/b/abc123",
  "recipient": "hash:…",
  "statusUrl": "https://nexus.gcri.org/status/abc123"
}

Streams: Optional Kafka/NATS topics for internal consumers (catalog.updates, qa.findings, security.keys.rotated).

10.5 OAI-PMH/OAI-ORE & Repository Ops

Endpoint: /oai with sets: courses, programs, articles, datasets.
Metadata formats: oai_dc, lrmi_json, jats, datacite_json.
OAI-ORE (optional): aggregates package course + artifacts + DOIs into a single discoverable resource map.
Refresh: on publish or rev bump; nightly reindex.

10.6 CI/CD for Catalog, Linter & WCAG Audits

Pipelines (per course/program):

  1. Schema & linter (codes, prereq DAG, min revs, i18n fields).
  2. Accessibility (automated WCAG 2.2 AA) + manual spot checks.
  3. Security (dependency SCA, secret scan).
  4. Psychometrics (if QZ changed): alpha & discrimination gates or pilot waiver.
  5. Release notes + rev bump (MAJOR/MINOR/PATCH) → staging → canary → prod.
    Blocking rules: any FAILED gate halts release; PATCH cannot alter outcomes.

10.7 Monitoring, Telemetry & SLA Targets

Monitors: API 5xx, latency, webhook failures, OAI errors, verification queue, badge issuance throughput, status list freshness, WCAG audit coverage.
KPIs:

  • API avail ≥ 99.9% monthly; p95 latency ≤ 300 ms read / 600 ms verify.
  • Webhook delivery success ≥ 99% within 5 min.
  • Badge issuance p95 ≤ 10 s; status propagation ≤ 15 min.
  • Catalog publish lead time (approved → live) ≤ 1 hour.
    Alerting: P1 (issuer key/verification outage), P2 (catalog publish failure), P3 (non-blocking regressions).

10.8 Backup, DR & Business Continuity

  • Backups: catalog, transcripts, badge registry, status lists, item banks, repository metadata.
  • Cadence: hourly incrementals, daily full; encrypted; cross-region.
  • RPO/RTO: Catalog/verify RPO ≤ 1h, RTO ≤ 4h; repository RPO ≤ 24h.
  • DR tests: semiannual failover drill; success criteria include verify endpoints, OAI harvest, badge issuance.

10.9 Partner Integrations (LMS, LTI, HR/ATS, Library)

  • LMS/LTI: Tools integrate via LTI 1.3/Advantage; return xAPI to LRS; QTI imports for assessments.
  • HR/ATS: /verify API + JSON-LD competencies (ESCO/O*NET) for automated parsing; optional 1EdTech CLR exports.
  • Library/Indexing: Crossref/DataCite deposits, JATS feeds, OAI-PMH for discovery; STAC/DCAT-AP for EO/data portals.
  • SSO/IdP: SAML/OIDC with just-in-time provisioning; RBAC mapped to roles in §10.1.

10.10 Roadmap, Change Requests & Community Contributions

  • Roadmap governance: Quarterly review board (R, PD, CO, NSF, QB, PE, LIB); publish public backlog highlights.
  • Change requests: File via KB portal; triage within 10 business days; classify as policy, schema, or feature; assign release train.
  • Community contributions: External partners may propose standards mappings, CPD tables, or datasets via signed CLA; all merges require QA & accessibility checks.
  • Deprecation policy: ≥ 180-day notice for API or schema removals; migration guides provided.
  • Transparency: Publish change logs (catalog, APIs, credential schemas) and quarterly reliability reports.

Acceptance Checklist (Ops, APIs & Governance)

  • Roles & RACI documented; governance calendar active.
  • REST APIs stable; versioning & deprecation policy published.
  • Webhooks signed; retries & DLQs configured.
  • OAI-PMH sets harvestable; repository DOIs resolve.
  • CI/CD gates enforced (linter, WCAG, psychometrics, security).
  • SLAs monitored; alerting & on-call runbooks in place.
  • Backups encrypted & tested; DR RPO/RTO met in drills.
  • Integrations validated (LTI, HR/ATS, library/indexing).
  • Roadmap & change request process live; deprecation notices honored.
  • Public quality & reliability reports published on cadence.