feat(live): connect verified simulators to sessions and prefetch - #243
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Live sessions now load approved simulators, queue missing instruments after the turn commits, and prefetch the next concept without waiting for generation. A cold or rejected build keeps the text lesson available; a published asset is selected on the concept’s next turn. Tutor reactions use verified teaching cases and validated state without awarding mastery for gestures.
Private HTML is fetched with bearer authentication and mounted inside a trusted wrapper. A browser regression showed that child-only CSP allowed self-navigation; the wrapper now blocks external frame navigation while preserving keyboard interaction, tutor demonstrations, reload recovery and separate learner state. The durable queue caps generation per session and learner, safely refreshes unpaid stale requests, and never automatically retries potentially paid work.
Validation: 3,164 Python tests, 1,752 web tests, 153 real database/REST tests and 15 browser tests passed. TypeScript, Ruff, formatting and database lint passed. ESLint has no errors and retains one existing CopilotSession Fast Refresh warning. Python/style, test and security reviews approved. Committed documentation includes an inspected authenticated-browser artifact and the explicit custom-protocol deviation.
Closes #236. The factory flag remains off by default. Dedicated supervisor deployment, multi-domain paid evaluation and production acceptance are #237; #217 remains open through its production rollout verification.