Make Studio → Courses the canonical course-operations surface

[alexeygrigorev]

Parent: #59

This is the naming and route-integration slice of the broader course-management parity epic.

Scope

Make the copied course-operations interface a section of the unified custom Studio, named Courses. Django /admin remains a separate framework administration surface. Preserve the copied course logic while changing the product navigation, canonical routes, route names, page titles, and links.

Canonical human surface: /studio/courses and its child routes.
Legacy /cadmin paths are staff-only compatibility redirects to the exact canonical destination while downstream references migrate.

Acceptance criteria

• Authorized users reach course operations through Studio → Courses; there is no separate Course admin navigation item.
• Every copied course-operation GET and POST route has one canonical /studio/courses destination and logical studio_courses route name.
• Legacy /cadmin paths do not render a second product surface: authorized requests redirect directly to the matching canonical destination, preserve query strings and method/body semantics where required, and never form chains.
• Anonymous and unauthorized requests cannot use compatibility redirects to discover or invoke staff operations.
• User-facing titles, headings, buttons, links, login/account pages, and messages use DataTalks.Club, Studio, Courses, or course operations; they do not expose cadmin, Course admin, or Course Management as the product name.
• Copied business logic is reused, not reimplemented; a temporary internal Python package name is allowed only as an explicitly documented compatibility seam owned by parent Move all course operations into Studio and the admin API #59.
• Django /admin remains reachable only under its own existing authorization and is not labeled Studio.
• Focused route, authorization, redirect, mutation, navigation, readable-template, and desktop/mobile Playwright tests pass.

Non-goals

This slice does not claim the full Studio/admin-API capability parity, shared-service extraction, or cadmin package retirement required by #59.

[alexeygrigorev]

Engineer implementation report

Outcome

• Course operations now appear as Studio → Courses at canonical /studio/courses/... routes with logical studio_courses_* URL names.
• The account menu has one management entry, Studio; course operators see Courses inside Studio. Django /admin/ remains separate.
• Every legacy /cadmin... path is staff-gated and redirects in one hop to its exact Studio Courses destination. Query strings are preserved; GET/HEAD use 302 and non-GET methods use 307 so request method/body replay semantics are retained.
• Browser-visible Course Admin/Course Management/cadmin product wording was replaced with DataTalks.Club, Studio, or Courses. The copied Python package/template namespace remains cadmin as the documented temporary implementation seam.
• The copied CMP behavior inventory and integration provenance manifests were regenerated/updated; no course business logic was reimplemented.

Implementation location

• Worktree: /home/alexey/git/dtc-website/.tmp/website-59-studio-courses
• Branch: issue-59-studio-courses
• State: uncommitted, ready for independent tester review

Verification

• Focused adoption/routes/OpenAPI: 25 passed
• Full cadmin suite: 96 passed
• Impacted courses/cadmin/accounts/studio/homepage regression: 611 passed
• make test-core: 716 passed
• make lint format-check django-check migrations-check: passed
• CMP adoption verifier: 768 copied files and 2 target-owned compatibility shims verified against pinned commit 98a2352
• Focused Chromium desktop/mobile Studio navigation: 2 passed
• Screenshots: .tmp/screenshots/issue-100/studio-courses-desktop.png and .tmp/screenshots/issue-100/studio-courses-mobile.png
• git diff --check: passed

Tester focus

• Exercise a mutating legacy /cadmin/... form path and confirm the browser follows the 307 while retaining the submitted body.
• Verify Studio → Courses and a populated course operations page at desktop and mobile sizes.
• Confirm unauthorized/non-staff legacy requests never expose the canonical staff destination.
• Confirm /admin/ still opens Django admin independently.

No commit, push, merge, or deployment was performed.

[alexeygrigorev]

Independent tester report — FAIL

Tested the frozen, uncommitted implementation in /home/alexey/git/dtc-website/.tmp/website-59-studio-courses on branch issue-59-studio-courses, HEAD ffc0f37b8631710546c825e2ebd8de85d40c478f. I did not fix, commit, push, merge, deploy, accept, close, or edit the issue checklist.

Blocking defects

1. A wrong-role Studio user can discover and invoke Course operations.

   The product policy in accounts/navigation.py:182-188 makes Courses available only to site_admin and course_operator. A synthetic active staff content_operator correctly saw no Courses navigation, but the same session received:

   • canonical GET /studio/courses/ → 200;
   • legacy GET /cadmin/ → 302 Location: /studio/courses/;
   • legacy POST /cadmin/campaigns/new/ → 307 /studio/courses/campaigns/new/ → 302 /studio/courses/campaigns/wrong-role-campaign/edit/, and the campaign was created.

   Both canonical views and compatibility redirects use cadmin.views.helpers.staff_required, which only checks authenticated is_staff (cadmin/views/helpers.py:49-58). This directly violates the acceptance criterion that unauthorized requests cannot use compatibility redirects to discover or invoke staff operations. Anonymous and non-staff users were denied correctly, but the role boundary is not enforced.

   Reproduction: uv run python .tmp/qa-115-replay.py. Relevant output:

   {'wrong_role': 'content_operator', 'courses_nav_visible': False,
    'canonical_status': 200, 'legacy_status': 302,
    'legacy_location': '/studio/courses/',
    'legacy_post_chain': [('/studio/courses/campaigns/new/', 307),
                          ('/studio/courses/campaigns/wrong-role-campaign/edit/', 302)],
    'mutation_created': True}
   

2. The populated canonical Course operations page overflows the mobile viewport.

   At 390 × 844, with a normal populated course (Data Engineering QA Mobile), one registration campaign, one homework, one project, and one enrollment:

   • window.innerWidth = 390;
   • document.documentElement.scrollWidth = 397;
   • the page-header title block ends at 396.96875px;
   • the full-page screenshot is consequently 397px wide rather than 390px.

   The current Playwright assertion in playwright_tests/test_single_identity.py:256-263 visits only the empty Courses list, so it passes without exercising the populated operation page requested in the tester focus. The same independent check is clean at 1280 × 720 and fails at mobile.

   Evidence:

   • .tmp/screenshots/issue-115/studio-courses-populated-desktop.png — 1280px wide, SHA-256 46e4c40afc0b13d32fe969cb4e2f493fd99f5dc9d4d7850284a4e531195082df
   • .tmp/screenshots/issue-115/studio-courses-populated-mobile.png — 397px wide from a 390px viewport, SHA-256 973665d80bd38d87bd40dbdac26f8c0b24296ea4da222bf0995edad4343083d2

   Reproduction: DJANGO_SETTINGS_MODULE=website.settings.test DJANGO_ALLOW_ASYNC_UNSAFE=true uv run pytest .tmp/qa-115-browser-test.py -v -s → desktop passed, mobile failed with the dimensions and offending nodes above.

Verified behavior that passed

• All 26 canonical operation definitions reverse to /studio/courses/... with studio_courses_* names.
• Every corresponding legacy child route redirects in one hop to the exact canonical path: GET/HEAD 302; POST/PUT/PATCH/DELETE 307.
• Raw duplicate, blank, and encoded query parameters were preserved exactly.
• A real followed multipart legacy campaign-create POST retained its body across the 307, created one campaign, and landed on the canonical edit page.
• Anonymous and non-staff GET/POST requests were denied on every canonical and compatibility route and could not mutate.
• Studio → Courses navigation works for a course_operator; there is no separate Course admin account-menu item.
• Visible populated pages contain none of cadmin, Course admin, or Course Management; the internal package/template namespace remains only as the documented compatibility seam.
• /admin/ independently rendered Django administration for the authenticated staff test session and was not labeled Studio.
• Copied CMP provenance verified: 768 copied files at pinned 98a2352... plus 2 target-owned shims.
• Development SEO/content preservation checks passed, including non-indexing headers, exact robots.txt, sitemap structure, and public content route SEO (45 tests).

Automated verification

• Focused route/campaign suite: 15 passed.
• cadmin + courses: 583 passed.
• make test-core: 716 passed.
• make test-playwright-core: 49 passed, 3 deployment-only skips.
• make lint format-check typecheck django-check migrations-check: passed.
• OpenAPI and management parity checks: passed.
• Adoption verifier and git diff --check: passed.

The green checked-in browser test does not cover the two failing adversarial cases above. Both blockers need correction and independent retest before acceptance.

[alexeygrigorev]

Engineer remediation report after independent QA failure

Both blockers are fixed in the existing uncommitted worktree.

Authorization remediation

• The shared copied course-operations guard now delegates to can_access_course_studio, so canonical /studio/courses... views and legacy /cadmin... compatibility redirects authorize only explicit site_admin and course_operator roles.
• Generic is_staff, unassigned staff, ungrouped superusers, and content_operator, event_operator, email_operator, support_operator, and auditor are denied before resource lookup or mutation.
• Copied homework/project compatibility entry points and their visible Studio links now use the same role boundary, preventing alternate-path bypasses or link disclosure to unrelated staff roles.
• Focused coverage exercises every one of the 26 canonical and legacy operations as a wrong-role content_operator using GET, HEAD, POST, PUT, PATCH, and DELETE. Legacy denial never returns a /studio/courses destination.
• The role matrix separately checks both allowed roles and all denied roles. A valid campaign-create payload is submitted for each denied role and no campaign is created.
• Authorized legacy GET/HEAD remain 302 one-hop redirects; POST/PUT/PATCH/DELETE remain 307. A followed valid POST proves the request body is replayed and the campaign is created only for an authorized operator.

Mobile remediation

• Studio page-header children are constrained to max-width: 100%/width: 100%, eliminating the populated page overflow.
• The course H1 no longer uses truncate; it wraps with the full exact title on mobile.
• The tracked Playwright regression now creates a populated course with a campaign, homework, project, and enrollment; navigates Studio → Courses → course operations; asserts the exact H1, asserts computed white-space is not nowrap, and asserts document.documentElement.scrollWidth <= window.innerWidth + 1.

Verification

• Focused role/routes/adoption test set: 21 passed; focused route suite alone: 13 passed, including the all-route/all-method denial matrix and real 307 body replay.
• Full relevant courses/cadmin/accounts/studio/homepage regression: 614 passed.
• make test-core: 716 passed.
• make test-playwright-core: 49 passed, 3 deployment-only skips.
• make lint format-check typecheck django-check migrations-check: passed.
• CMP adoption verifier: 768 copied files at pinned 98a2352... plus 2 target-owned compatibility shims verified.
• git diff --check: passed.

Fresh issue-specific screenshots

• Desktop: .tmp/screenshots/issue-115/studio-courses-populated-desktop.png, 1280×1327, SHA-256 158fdc279e796ebbeeaf3d5cbda76e75799e400719b6e24eab4a64df43b0ff9e
• Mobile: .tmp/screenshots/issue-115/studio-courses-populated-mobile.png, 390×1798, SHA-256 b738bcb8068f1262c1d4171b148fb832f41337ec7792122eed8424bb26ccea62
• I visually inspected both. The mobile screenshot is exactly 390px wide and displays the complete wrapped Data Engineering Studio 390 H1.

Implementation remains in /home/alexey/git/dtc-website/.tmp/website-59-studio-courses on issue-59-studio-courses, uncommitted. No commit, push, merge, deployment, acceptance, issue closure, or checklist edit was performed. Ready for a fresh independent tester pass.

[alexeygrigorev]

Independent remediation re-QA — FAIL

I independently retested the remediation in the latest engineering report, using the prior QA failure as the adversarial baseline.

Candidate: branch issue-59-studio-courses, HEAD ffc0f37b8631710546c825e2ebd8de85d40c478f, still uncommitted with 81 tracked modified paths and 2 untracked source files. Current frozen fingerprints:

• tracked binary diff: 1bbb48c1c6863934432d086587ff1902891afca661d5135cf1c5278146529806
• sorted untracked path + Git-object manifest: d84067084ae896b176666582ec94d65d73875c67ae04b2bb5d4beb26aebebeda
• raw tracked diff + manifest: 1e33fbd4ae132c1a2c0249b043b9dfa834e4b820b43629b4f8dd8cfc3007aecd

Blocking failures

1. The checked compatibility route contract is inconsistent with the new canonical route inventory.

   make test stops in test-compatibility: 1 failed, 288 passed. The focused reproduction is:

   uv run pytest compatibility/tests/test_baseline.py::test_course_route_inventory_matches_all_adopted_urlconfs -vv

   compatibility/tests/test_baseline.py::test_course_route_inventory_matches_all_adopted_urlconfs compares the pinned _docs/compatibility/course-route-contracts.json with scripts.render_course_platform_inventory.route_entries(). The pinned contract still contains 26 Course administration rows at /cadmin/... with cadmin_* names, while the candidate renderer now returns 26 Studio Courses rows at /studio/courses/... with studio_courses_* names. All 26 rows disagree.

   Expected: the full compatibility gate passes while preserving the pinned source provenance and separately expressing the approved target canonical/legacy relationship. Actual: the repository's source contract and current inventory disagree, so make test is red.

2. The safe local-review course-operations workflow was not migrated to the new role/route boundary.

   The full Django command also fails:

   DJANGO_SETTINGS_MODULE=website.settings.test uv run python manage.py test --parallel

   Focused reproduction:

   DJANGO_SETTINGS_MODULE=website.settings.test uv run python manage.py test review_import.tests.test_workflow.ReviewImportWorkflowTests.test_local_review_browsing_never_constructs_network_clients -v 2

   This test fails because its isolated browser probe exits 33: it expects the generated synthetic review administrator to receive 200 from /cadmin/, but the request now receives 302. review_import.admin.create_synthetic_admin() creates an active staff superuser without an explicit site_admin or course_operator group, while the remediated guard correctly denies ungrouped superusers. The same downstream probe still expects rendered /cadmin/cloudwatch/ and /cadmin/datamailer/ links instead of the canonical Studio Courses destinations.

   Expected: the safe local-review administrator is explicitly authorized under the new policy and the workflow exercises canonical Studio Courses plus the compatibility redirect contract without constructing network clients. Actual: the workflow can no longer reach course operations, and the full Django suite is red. The parallel runner additionally emits Django's secondary unpicklable-traceback error after this assertion; the serial focused test above isolates the real failure.

Per the tester process, either repository test failure is blocking; both need remediation and a fresh independent retest.

Prior blockers now verified fixed

• Full route/role boundary: an independent harness resolved all 26 canonical names to /studio/courses/... and the exact copied callbacks. For both allowed roles (course_operator, site_admin), 312 legacy route/method checks passed: GET/HEAD return one-hop 302, POST/PUT/PATCH/DELETE return 307, and every Location is the exact canonical destination.
• Exact query semantics: duplicate keys, blank values, %2F/%3F encodings, +, and double-encoded values were preserved byte-for-byte on every authorized redirect, including /cadmin without a slash.
• Denied roles and mutation safety: 3,432 canonical/legacy route-method denials passed across anonymous, learner, every unrelated Studio role, unassigned staff, grouped non-staff, inactive course operator, and ungrouped superuser. A valid content_operator campaign-create POST to each canonical and legacy endpoint returned the login denial and created zero campaigns.
• Authorized body replay: a real multipart legacy campaign-create POST produced a first-hop 307 with the exact raw query, replayed the complete body, created exactly one campaign, and ended at its canonical /studio/courses/campaigns/.../edit/ page.
• Mobile remediation: independent browser measurements at a 390px viewport found window.innerWidth = document.documentElement.scrollWidth = document.body.scrollWidth = 390. The exact H1 text was retained, white-space: normal, overflow visible, heading width 358, heading client/scroll height both 86, and three rendered lines. Desktop remained exactly 1280px wide.
• Naming/navigation/admin: browser navigation is Account menu → Studio → Courses with no separate Course admin item. The populated page contains none of cadmin, Course admin, or Course Management. /admin/ separately returns Django administration and is not labeled Studio.
• Copied provenance: uv run python scripts/verify_course_platform_adoption.py passed: 768 copied files at pinned 98a235283904b4ef9ad29e196298540756cf1bcc plus 2 target-owned compatibility shims.

Fresh independent screenshots were captured and visually inspected; both show the populated course, campaign, homework, project, enrollment metrics, complete title, correct Studio/Courses breadcrumbs, and no error/debug/broken state:

• .tmp/screenshots/issue-115/studio-courses-populated-reqa-desktop.png — 1280×1327 — SHA-256 95235d7efc4338407328ffb0469d44990e54c75cd7bb2978095e51fdd59767c0
• .tmp/screenshots/issue-115/studio-courses-populated-reqa-mobile.png — 390×1851 — SHA-256 6be29059313873245bf3686a77b07bea72615be8bda7b1e89823046f4f7d7632

Other verification

• focused route/adoption/navigation/course-link set: 48 passed
• relevant cadmin + courses + account/Studio/homepage suite: 614 passed
• independent populated-browser test: 2 passed
• make test-core: 716 passed
• make test-playwright-core: 49 passed, 3 expected deployment-only skips
• make lint format-check typecheck django-check migrations-check database-portability-check terminology-check and git diff --check: passed (348 formatted files; 271 typed files; OpenAPI and management parity current)
• make test: FAIL at compatibility (1 failed, 288 passed); full Django run separately FAILS on the local-review workflow above

Verdict: FAIL. I did not edit product/source files, accept or close the issue, check checklist items, commit, push, merge, or deploy anything.

[alexeygrigorev]

Engineer re-remediation report after independent compatibility/local-review failure

Both remaining tester blockers are fixed in the existing uncommitted candidate worktree.

Compatibility contract and provenance

• The established pinned-source generator now records the 26 target-owned Course operations as the canonical Studio Courses surface at /studio/courses/... with studio_courses_* route names.
• Every generated route row separately retains its exact pinned CMP source identity through source_example_path, source_route_pattern, and source_name. The 26 source rows remain exact /cadmin/... and cadmin_* contracts at revision 98a235283904b4ef9ad29e196298540756cf1bcc.
• Compatibility loaders and validators fail closed if the canonical Studio target and pinned source mapping disagree.
• Legacy machine samples continue to check /cadmin independently. The regenerated public-contract inventory is byte-identical: 5,507 rows, SHA-256 50f875806217865ef35b74f58ed885c4b5c832284391dbea7f84344d3416f66d.
• The artifact was regenerated from the project-local pinned workspace through scripts/build_pinned_legacy_sources.py --artifacts-only; a scoped byte-for-byte generator check confirms the Course route and machine-contract artifacts are current.

Safe local-review role and route boundary

• The synthetic review administrator now receives exactly the least-privilege course_operator Studio role and its code-owned core.access_studio permission. The review database does not materialize unrelated Studio roles.
• Final database validation requires that exact user/group/permission relationship while retaining zero-count checks for every other sensitive account/authorization table.
• The no-network browser probe now exercises canonical /studio/courses/, CloudWatch, and Datamailer pages and checks the rendered canonical links.
• Legacy /cadmin/, /cadmin/cloudwatch/, and /cadmin/datamailer/ are covered separately as exact one-hop compatibility redirects with query preservation. Unsafe review-mode POST remains denied without a redirect.
• The probe still proves no AWS, HTTP, Datamailer, or raw-socket client is constructed.

Verification

• Focused compatibility suite: 289 passed
• Focused local-review Django suite: 27 passed
• make test: 289 compatibility tests passed; 1,481 Django tests passed
• make test-playwright-core: 49 passed, 3 expected deployment-only skips
• make lint format-check typecheck django-check migrations-check terminology-check database-portability-check: passed
• uv lock --check: passed
• Public-contract manifest check: 5,507 valid rows with the unchanged digest above
• CMP adoption verifier: 768 copied files at the pinned revision plus 2 target-owned compatibility shims
• Course-platform behavior inventory check and git diff --check: passed

This remediation changes generated contracts and safe review tooling only; it does not change a visual product surface, so no replacement screenshots were needed. The prior independently inspected desktop/mobile product screenshots remain applicable.

Implementation remains in /home/alexey/git/dtc-website/.tmp/website-59-studio-courses on issue-59-studio-courses, uncommitted. I did not commit, push, merge, deploy, accept, close, or edit the checklist. Ready for a fresh independent tester pass.

[alexeygrigorev]

Engineer integration refresh before independent re-QA

The uncommitted #115 candidate is now based on current origin/main.

• Branch: issue-59-studio-courses
• New HEAD: b1edf2fb0049da6fb451699eac7caa4740b96c4b
• Upstream relation: HEAD...origin/main = 0 0
• Working tree: 92 tracked modified paths, 2 untracked candidate paths, 0 staged paths, 0 unresolved paths
• Tracked binary-diff SHA-256: de8bf7a8c3d9f7050f74438dbdcc0546e81294bfd9da6553ecb1e66521cddaf4
• Sorted untracked path/object manifest SHA-256: 3eaa02c94e96459047d2df55abbd3272cc73719371f856560f816f4a55c2ad0b

I used a recoverable named stash, verified its complete 94-path contents, fast-forwarded from ffc0f37b to b1edf2fb, and reapplied the candidate. The sole conflict was accounts/studio_roles.py; resolution retains both accepted #112 historical-registration permissions for site_admin/event_operator and #115’s least-privilege set_single_studio_role helper. studio/views.py merged cleanly and retains both accepted event capabilities and Studio → Courses navigation. Because stash pop encountered the conflict, the named recovery entry remains as stash@{0}: issue-115 Studio Courses candidate before origin-main b1edf2fb.

Post-integration verification

• Compatibility: 289 passed
• Canonical/legacy Course routes plus safe local review: 40 passed
• Accepted-main Import historical registration totals safely and show aggregate event counts #112 events and Recover fail-closed ECR manifest verification for active release capture #117 deployment regression: 150 passed
• Focused Studio identity Playwright: 10 passed
• Public-contract manifest: 5,507 valid rows, unchanged SHA-256 50f875806217865ef35b74f58ed885c4b5c832284391dbea7f84344d3416f66d
• Pinned Course/machine artifacts: byte-for-byte current
• CMP adoption: 768 copied files at pinned 98a2352... plus 2 target-owned shims
• Course behavior inventory: current
• Lint, format, mypy, Django/OpenAPI/parity, migration drift, and git diff --check: passed

No candidate commit, push, merge commit, deployment, acceptance, closure, or checklist edit was performed. Ready for independent re-QA at the new HEAD.

[alexeygrigorev]

Independent re-QA — FAIL

I independently tested the refreshed, uncommitted candidate in /home/alexey/git/dtc-website/.tmp/website-59-studio-courses after its current-main integration. I did not edit source, commit, push, merge, deploy, accept, close, alter the checklist, or touch the retained recovery stash.

Candidate fingerprint before and after QA:

• branch issue-59-studio-courses
• HEAD and origin/main: b1edf2fb0049da6fb451699eac7caa4740b96c4b (0 0 divergence)
• 92 tracked changes and 2 untracked candidate files
• tracked binary diff SHA-256: de8bf7a8c3d9f7050f74438dbdcc0546e81294bfd9da6553ecb1e66521cddaf4
• status manifest SHA-256: 2cfdac8a2b3f7592786d9b51ae2511513836efee16ffb52c3dc6bc6c5e6d066e
• untracked cadmin/legacy_urls.py: 6f5dbf60cd4423edb73b50d65b6ea22cd56ccb2739e112aa129d307c6574631a
• untracked cadmin/tests/test_studio_course_routes.py: 67f3ba1360e37cb9f0be1f479cae70af2b6c88cd27874c192c6be01fe22d9219
• retained stash@{0}: issue-115 Studio Courses candidate before origin-main b1edf2fb remains present and untouched

Blocking failure: complete pinned-source artifact freshness is red

The repository-owned offline byte-for-byte gate fails reproducibly:

uv run python scripts/build_pinned_legacy_sources.py --check
checked source artifacts are stale: generated-path-baseline.jsonl, source-build-provenance.json

Independent comparison against build_artifact_payloads() from the current pinned workspace produced:

• generated-path-baseline.jsonl: checked SHA-256 d078787a465b916e8005b11405b960bdf55906a5fe586f5f4c1f1507d01c719b; generated SHA-256 8a849610cad816a0ef1650397f3e7cc2e2a3095dd935a169408a0d647dad9501. Both are 1,515,594 bytes, but generated content digests differ, including Rustkyll manifest/feed and generated main-site records.
• source-build-provenance.json: checked SHA-256 67d56790277e8e0af06c97f657de14db39121eeea1b3f480b7a273f36ae5d847; generated SHA-256 adf4d649ebc135c24c39f4ff2258c6c79d6546812347cbfe6aa3929533f07081. The current generator reports different output-tree digests for dtc-docs, dtc-main-site, and dtc-podwiki.

This is the full generator freshness/determinism gate requested by the acceptance handoff. A scoped Course artifact check is insufficient while the generator's complete six-artifact output disagrees with two checked artifacts. The candidate therefore cannot pass independent technical QA yet.

Course contract and prior blockers otherwise pass

The actual Course route contract is structurally correct:

• _docs/compatibility/course-route-contracts.json has 89 rows: 9 Accounts, 29 Compatibility API, 26 Studio Courses, and 25 Public courses.
• All 26 Studio rows have canonical /studio/courses/... paths and studio_courses_* names plus separately pinned /cadmin/... source_route_pattern/source_example_path and cadmin_* source_name at revision 98a235283904b4ef9ad29e196298540756cf1bcc.
• Course contract SHA-256: f16f209e33ef9338ced22589048bfd998abf9269f24bb7f1ed889cb4b9fc4902.
• Generated behavior-inventory check passes. The public-contract artifact remains 5,507 rows with SHA-256 50f875806217865ef35b74f58ed885c4b5c832284391dbea7f84344d3416f66d.

Independent authorization/compatibility stress checks passed:

• 26 canonical route names resolve to the exact copied callbacks.
• 312 authorized legacy route/method checks passed for course_operator and site_admin: GET/HEAD are exact one-hop 302s; POST/PUT/PATCH/DELETE are exact 307s; duplicate, blank, encoded, plus, question-mark, and double-encoded query values remain byte-for-byte intact.
• 3,432 canonical/legacy route/method denial checks passed across 11 identities: anonymous, learner, five unrelated Studio roles, unassigned staff, grouped non-staff, inactive course operator, and ungrouped superuser. Legacy denial never exposes a Studio destination.
• Valid denied campaign-create submissions on both surfaces created zero campaigns.
• Direct no-slash /cadmin passed 12 authorized and 24 denied method checks with exact query and method semantics.
• The tracked real multipart 307 replay test passed and created the authorized campaign only after replay at its canonical destination.
• The safe local-review workflow passed: the synthetic administrator has exactly course_operator, canonical Studio Courses/CloudWatch/Datamailer probes work, legacy redirects are checked separately, unsafe POST is denied, and no network client is constructed.
• /admin/ remains independently namespaced Django administration, returned 200 under its existing staff policy, and was not labeled Studio.

Automated and visual verification

• focused route/local-review/adoption suite: 46 passed
• make test: 289 compatibility tests and 1,514 Django tests passed
• make test-playwright-core: 53 passed, 3 expected deployment-only skips, including accepted Import historical registration totals safely and show aggregate event counts #112 historical-registration desktop/mobile preservation
• lint, format check (357 files), mypy (279 files), migration drift, Django/OpenAPI/management parity, terminology, database portability, legacy-manifest validation/comparison, uv lock --check, and git diff --check: passed
• CMP adoption verifier: 768 copied files at pinned 98a2352... plus 2 target-owned compatibility shims

I regenerated and inspected the current populated Studio Courses originals:

• desktop: 1280×1327, SHA-256 0e3cbcd7fb5f5d5f9a6aa6855895fce8a1b850789b2420d9c30742adce12bcf5
• mobile: 390×1798, SHA-256 9538f29bb2b92b2a3e411b1091dd5d8ae61783128f96327e4c22c84b9e7ac74c

Both show the intended populated course operations page—not a 404/debug/error page—with Studio/Courses breadcrumbs, campaign, enrollment metrics, homework, and project. Mobile is exactly 390 px wide; the complete Data Engineering Studio 390 heading wraps cleanly, controls remain readable, and no horizontal clipping or broken layout is visible.

Verdict: FAIL solely because the complete checked pinned-source generator output is stale. The prior authorization, local-review, and mobile blockers are fixed.

[alexeygrigorev]

Software engineer freshness investigation — BLOCKED\n\nThe narrow pinned-source refresh was run in the isolated #115 worktree. No route/runtime behavior, stash, commit, push, merge, deployment, acceptance, closure, or checklist state was touched.\n\nCurrent artifact state:\n\n- scripts/build_pinned_legacy_sources.py --check passes against the current scratch output.\n- Only generated-path-baseline.jsonl and source-build-provenance.json are additional tracked changes.\n- Current hashes: generated baseline cdad4d9249e497db2c15c77a97bed3fb97f77c40d9154d76ce6c4c651d2861c6; provenance bd13dcf388976af17090342b1a4f7575430495f32df61d304998e17f45b14807.\n- All 2,937 paths, source identities, revisions, and output counts are unchanged. Exactly 209 baseline rows change, only in content_sha256: 205 main-site, 2 docs, 2 Podwiki; 203 HTML, 3 JSON, 3 XML. Provenance changes only the matching three output-tree digests.\n- Course route contract remains f16f209e33ef9338ced22589048bfd998abf9269f24bb7f1ed889cb4b9fc4902. Public contracts remain 5,507 rows at 50f875806217865ef35b74f58ed885c4b5c832284391dbea7f84344d3416f66d.\n\nBlocking reproducibility evidence:\n\n- Two consecutive complete clean builds of the same detached pinned revisions produced different artifact pairs: f9e439c7… / cbfce64c… and then 88a10499… / 183cceb9…. An earlier artifacts-only projection was 8a849610… / adf4d649….\n- A bounded byte comparison found the exact causes: docs and Podwiki feeds contain wall-clock updated values; 203 main-site podcast pages contain wall-clock structured-data endDate values; main-site sitemap ordering changes; Rustkyll manifest map ordering changes.\n- Thus checking in the latest timestamp/order makes the immediate offline check green but does not make the full pinned-source build reproducible. A durable fix requires deterministic normalization in the established generator.\n\nBounded gates otherwise pass: 33 focused compatibility/adoption/Studio route tests with 1,159 subtests; 27 safe local-review tests; CMP verifier (768 copied files plus two shims); compatibility manifest validation/comparison; generated inventory; lint; formatting (357 files); mypy (279 files); Django/OpenAPI/parity; migrations; portability; terminology; uv lock; and git diff check.\n\nCandidate fingerprint:\n\n- HEAD b1edf2f\n- origin/main advanced during this investigation to 5b6a841; candidate is now behind by two commits.\n- 94 tracked modified paths, two untracked candidate files.\n- Tracked binary diff SHA-256: 7d9e720c4c10bc0c525c4fc4c415723d9a6af4d744086fab7082f21e97eecaff.\n- Untracked hashes: legacy_urls.py 6f5dbf60cd4423edb73b50d65b6ea22cd56ccb2739e112aa129d307c6574631a; test_studio_course_routes.py 67f3ba1360e37cb9f0be1f479cae70af2b6c88cd27874c192c6be01fe22d9219.\n- Retained recovery stash remains untouched.\n\nStatus: BLOCKED on deterministic pinned-source normalization, followed by current-main integration and fresh independent QA.

[alexeygrigorev]

The generator reproducibility blocker found during independent QA is now tracked with bounded cross-repository acceptance criteria in #118. Keep #115 uncommitted and unaccepted until #118 is implemented, the website pin/artifacts are refreshed on current main, and independent #115 QA passes again.