Section 3: System Architecture Matrices & Reference Pipelines
CaC vs. CaaS Technical Comparison
| Dimension |
Curriculum as Code (CaC) |
Curriculum as a Service (CaaS) |
| Primary Focus |
Infrastructure, source files, and developer tools. |
Scalable delivery, cloud platforms, and LMS. |
| Tool Stack |
Git, GitHub, Antigravity IDE, Markdown, Python, Local Gemma. |
Canvas, Moodle, PowerSchool, Workspace Studio, Gemini LTI. |
| Core Method |
Filesystem as Memory (Context Stack, Clinical Framing Protocol: Pattern / Rule / Solve). |
Programmatic APIS, turnkey integrations, cloud syncing. |
| Accessibility |
Built-in at the source code level (strict 9:1 contrast, h2-h4). |
Rendered on responsive mobile and web portals natively. |
| Sovereignty |
High: Air-gapped, zero-cloud leak, local inference. |
Moderate: Secure cloud-tenant environment, tenant-controlled. |
Technical Architecture Spotlight: Blackboard LOR Core Overlays & Supplemental Course Sync
This architecture maps how a centrally managed LOR folder is synced down to course instances, while allowing course-specific, local supplemental overrides to render within the same structure:
[LOR Core Master Package (UUID)] ──(Lock & Global Sync)──> [Course Instance Shell]
│
▼
[Course-Specific Content (Supplemental Modules)] ──(OAuth 2.0 API)──> [Overlay Array]
│
▼
[Unified Course View (Ultra)]
- 1. Global Packaging: The administrator publishes a locked, centrally managed curriculum folder in the Learning Object Repository (LOR) with a unique UUID.
- 2. Continuous Synchronization: The Blackboard LOR engine automatically syncs the master package down to all active course shells.
- 3. Local Supplemental Overlay: Individual instructors use the Ultra API or Course Editor to append localized course-specific folders (local overrides) onto the LOR container.
- 4. Unified Rendering: The course Ultra interface overlays local files with the locked LOR core package, creating a tailored student view without breaking the upstream sync.
Technical Architecture Spotlight: Incremental GCS Backup & Disaster Recovery Pipeline
This architecture maps how version-controlled curriculum states and active gradebook databases are incrementally compiled and backed up into secure Google Cloud Storage (GCS) buckets programmatically:
[Google Workspace Tenant Data] --(DLP Scanning)--> [Incremental Backup Engine]
|
V
[GCS Bucket (Corporate Tenant)] \<---------------(OAuth2 Service Account)
|
V
[Local Archival SSoT]
Technical Architecture Spotlight: Google Apps Script Core Execution & Compliance Pipeline
This architecture maps the secure, enterprise-grade execution boundary for Google Apps Script custom automation pipelines running on top of version-controlled course materials:
[Local Curriculum Git / Sheets Data] ──> [Google Apps Script (Core Service VM)]
│
├─► [Admin DLP Interceptor] (Enforces Data Leak Policies)
├─► [Google Vault Audit Logs] (Enterprise Archiving)
│
▼
[Secure Local Google Drive SSoT]
Technical Architecture Spotlight: Workspace Studio + NotebookLM Flow
[Google Drive Sources] ──(Auto-Sync)──> [Grounded Notebook]
│
▼
[Trigger Event (e.g. Schedule/Email)] ──> [Workspace Studio Flow]
│ (Ask NotebookLM Step)
▼
\[Grounded AI Response\]
│
┌─────────────────────┴─────────────────────┐
▼ ▼
\[Dynamic Email Output\] \[LMS / Chat Update\]
Technical Architecture Spotlight: LOR Package Syncing & Programmatic Accommodations Pipeline
This closed-loop architecture demonstrates how a central curriculum update in the LOR is dynamically pushed to courses, while user-specific accommodations are programmatically synchronized using the Blackboard Ultra API:
[Central LOR Folder Update] ──(Dynamic Sync)──> [Active Blackboard Ultra Courses]
▲
│ (LMS accommodations API)
▼
[Student Accommodations Master Directory] ───> [Automated Python Script / API Call]
Technical Architecture Spotlight: The Gemini LTI 1.3 OIDC Launch & Auto-Import Pipeline
[Moodle / Canvas LMS] [LTI OIDC Login] [Gemini LTI Backend / NotebookLM]
│ │ │
│ ──(1) Click LTI Tool ───────────────>│ │
│ │ ──(2) Validate Launch Token (JWKS)──>│
│ │ │
│<──(3) Query Course Files API ────────│ │
│ │ │
│ ──(4) Direct Stream of Course Docs ────────────────────────────────────────>│
│ │ [Parsed & Vectorized]
Technical Architecture Spotlight: The Policy-as-Code Security Deployment Pipeline
Technical Architecture Spotlight: Google Meet Explicit AI-Recording Consent & Compliance Loop
[AI Tool Activation (Recorder/Transcriber)] ──> [Google Meet Room Session]
│
▼
[Mandatory Consent Prompt UI]
│
┌─────────────────────────┴─────────────────────────┐
▼ (Approved) ▼ (Declined)
[Session Recording Initiated] [Auto-Removal / Blocked State]
Technical Architecture Spotlight: AESTR's Living Syllabus & JIT Learning Continuous Integration Loop
[Industry Breakthrough / Tech Release] ──(48-Hour Patch Window)──> [Continuous Deployment (SaaS Model)]
│
▼
[Project-Based Assessment Gate] <──(Required Knowledge Node)── [Just-in-Time Learning Environment]
This architecture shows how Security-as-Code principles are programmatically compiled and pushed directly to the Google Admin console via the Workspace Policy API, bypassing the manual web interface:
[DLP JSON/YAML Rules Repository] ──(GitHub Commit)──> [CI/CD Validation Runner]
│
│ (Workspace Policy API)
▼
[Google Admin Console DLP Engine]
│
┌──────────────────┴──────────────────┐
▼ ▼
[Drive File Scans] [Chrome Security]
Technical Architecture Spotlight: The DBSC Cryptographic Session Maintenance Loop
Technical Architecture Spotlight: The Localized Sovereign Ingestion & Interactive Activity Pipeline
This architecture maps how a localized educational developer programmatically compiles version-controlled curriculum files within domestic regional boundaries, compiles them into interactive learning objects using H5P's Smart Import, and deploys them to a Canvas instance secured by mandatory admin MFA:
[Local MD Source Repository (.md)] ──(Git Commit)──> [GCP europe-west2 Workspace]
│
▼ (In-Region at-Rest DRZ & MLP)
[NotebookLM Enterprise (UK)]
│
▼ (Smart Import)
[H5P Interactive Generator]
│ (LTI 1.3 Connection)
▼
[Hardened Canvas LMS (UK)]
▲
│ (Mandatory MFA Verification)
[Sovereign Admin Login]
1. Regional Ingestion: A curriculum designer commits a local Markdown file. A webhook pushes it to a GCP workspace configured in the United Kingdom (europe-west2) or Japan (asia-northeast1).
2. Sovereign ML Processing: The source document is vectorized and processed inside NotebookLM Enterprise, utilizing the newly released localized region support to guarantee that data processing (MLP) and storage (DRZ) remain strictly within domestic borders.
3. Interactive Generation: The structured text files are passed to H5P’s upgraded Smart Import engine, which programmatically compiles raw context into interactive, graded learning objects.
4. Hardened LTI Deployment: The compiled learning object is securely published to a Canvas instance over an LTI 1.3 connection. Administrative access and configurations are shielded by mandatory Multi-Factor Authentication (MFA), preventing cross-tenant security compromises.
[User Device (Chrome)] [Google Workspace Server]
│ │
│ ──(1) Sign in & Key Registration (TPM)─────────>│
│ │
│<──(2) Issue Session Cookie + Public Key Bind───│
│ │
│<──(3) Cryptographic Challenge (Every 5 mins)───│
│ │
│ ──(4) Sign Challenge with TPM Private Key─────>│
│ │
│<──(5) Validate Signature & Issue Bearer Token───│
│ │
Technical Architecture Spotlight: Google Classroom App in Gemini Contextual Collaboration Loop
[Google Classroom LMS] ──(Scoped API Query)──> [Google Classroom App in Gemini]
│
▼
[LMS Context (Syllabi/Rosters)] ─────────────> [Gemini Conversational Chat Engine]
│
▼
[Grounded Materials (Drafts/Activities)] ────> [Automated Classroom Publishing]
Technical Architecture Spotlight: Programmatic CaC Ingestion Pipeline via NotebookLM Enterprise API
Technical Architecture Spotlight: The Antigravity Agentic Code Execution & Isolation Loop
This architecture demonstrates how the Antigravity engine secure-sandboxes a Python compilation container to programmatically analyze data sources within NotebookLM:
[User Prompt: Run Cohort Engagement Trends]
│
▼
[Gemini 3.5 Generates Custom Python Script]
│
▼
[Spins Up Isolated Cloud Virtual Machine]
│ (VPC-SC Secured Sandbox)
▼
[Executes Python Script on Sourced Spreadsheet]
│
▼
[Outputs Dynamic Charts & Refined Spreadsheets]
Technical Architecture Spotlight: Headless NotebookLM CI/CD Compilation via MCP & CLI Servers
[Local Markdown Files (CaC)] ──(Git Commit)──> [GitHub Actions CI/CD Pipeline]
│
▼
[NotebookLM MCP Server / CLI] ◄──────────────(Ingest / Update API)
│
▼
[Secure Cloud / VPC-SC Sandbox] ───────────> [Grounded Notebook Fleet (CaaS)]
Technical Architecture Spotlight: The Gemini Canvas to Classroom Dynamic Deployment Pipeline
This architecture maps how interactive learning assets are programmatically compiled inside an isolated client-side sandbox (Gemini Canvas) and deployed securely into Google Classroom LMS assignment flows via native Classroom API endpoints:
[User Generates Interactive Web App / Quiz / Game (Gemini Canvas)]
│
▼
[Native "Share to Classroom" API Publishing Request]
│ (OAuth 2.0 / LTI Token)
▼
[Google Classroom Classwork Ingestion Endpoint]
│
▼
[Appended Sandboxed Learning Object in Classroom Stream]
This architecture demonstrates how version-controlled curriculum files (Markdown) are programmatically compiled and pushed directly to a fleet of secure, enterprise notebooks:
[GitHub Repo (.md)] ──(Webhook / CI/CD)──> [GCP Cloud Run Compiler]
│
│ (NotebookLM Enterprise API)
▼
[Corporate IdP (Okta)] ──(OIDC/SAML)──> [Workforce Identity Pool]
│
▼
[Grounded Enterprise Notebook]
│ (VPC-SC Secured)
▼
[Institutional Fleet Delivery]
Technical Architecture Spotlight: The Iterative Curriculum Loop & Batch Audit Flow
This architecture shows a Workspace Studio flow that utilizes the new looping construct to execute a batch accessibility and standards audit over a directory of version-controlled curriculum files:
[Trigger: Folder Modified]
│
▼
[List Files in Google Drive]
│
▼
[For Each File in List (Loop)] ──┐
│ │
├─► [Read File Content] │ Iterative
│ │ Execution
├─► [Ask NotebookLM Step] │ For Each Module
│ (Verify WCAG & Rubrics) │
│ │
└─► [Append Log to Draft Doc] ─┘
│ (Loop Completed)
▼
[Compile Master Audit Report]
│
▼
[Send Notification to ID Team (Gmail / Chat)]
Technical Architecture Spotlight: The Multi-Source Ingestion & Dynamic Compliance Loop
This architecture demonstrates how "Ask Gemini in Drive" synthesizes active communication (Gmail) and static materials (Drive), while Google Calendar DLP rules dynamically govern sensitive data boundaries at the scheduling layer:
Technical Architecture Spotlight: The LTI-Bound Competency Gate & Automated Ingestion Loop
This architecture maps a closed-loop system where an AI-driven assignment satisfies institutional competency pathways, which in turn triggers automated file organization within Google Drive:
[Student Completes Gemini LTI Assignment]
│
▼
[LMS Evaluates Score against Threshold]
│
▼
[Satisfies Canvas Outcomes Assessment Gate]
│
▼
[Unlocks Instructure Pathway Milestone]
│
▼
[Triggers "Organize My Files in Drive" Flow]
(AI-driven folder restructuring & archiving)
[Student / Faculty Work Environment]
June 14, 2026 — Gemini 3.1 Pro Launch, Separate Pedagogical Descriptions, and LTI Developer Key Standardization
On this date, the continuous research monitor captured Google's preview release of Gemini 3.1 Pro and crucial structuring and developer updates from Anthology Blackboard and Instructure Canvas. These updates represent the programmatic integration phase of Curriculum as a Service (CaaS) and the technical hardening of Curriculum as Code (CaC) compliance.
1. Gemini 3.1 Pro Preview Release (June 13, 2026)
Classification: Curriculum as Code / Model Infrastructure Upgrade
Key Mechanism: Google has released Gemini 3.1 Pro in preview, targeting enhanced core reasoning skills for complex problem-solving and ambitious agentic workflows Google released Gemini 3.1 Pro with complex problem-solving skills. It builds upon the Gemini 3 Deep Think framework.
Impact on CaC: Moves CaC beyond standard retrieval and basic summary models. Designers can leverage Gemini 3.1 Pro's advanced reasoning to synthesize multi-source course files, generate visual explanations of highly complex technical subjects, and execute multi-step agentic workflows with greater stability and logical accuracy.
2. Separate Dedicated Descriptions for LMS Discussions & Journals (Blackboard 4000.19 - June 13/14, 2026)
Classification: Curriculum as Code / Structured Pedagogical Outlines
Key Mechanism: In the newly deployed July 2026 release stage (4000.19), Discussions and Journals in Blackboard Ultra now feature a dedicated, separate Description field, isolated from the core prompt text What's New - Anthology Help Center.
Impact on CaC: This enforces a clear separation of concerns in course design files. Instructors and designers can structure expectation guidelines, grading rubrics, and formatting standards as metadata in the Description field, while keeping the main prompt block strictly reserved for the core question. This matches standard programming practices (separating instructional metadata from functional code).
3. Deprecation of Regional LTI Developer Keys in Canvas (June 12, 2026)
Classification: Curriculum as a Service / LTI Security Standardization
Key Mechanism: Instructure has officially deprecated legacy, region-specific LTI developer keys for Canvas Portfolio, replacing them with a single, inherited unified developer key (170000000001986) Canvas Release Notes (2026-03-21) - Instructure Community.
Impact on CaaS: Standardizes and simplifies the platform's multi-tenant integration footprint. Administrators can deploy global, federated student portfolio engines across dozens of subaccounts with a single, secure key rather than managing regional developer key matrices, reducing administrative overhead.
│
┌─────────────────────────┼─────────────────────────┐
▼ ▼ ▼
[Active Gmail Threads] [Drive course files] [Google Calendar Events]
│ │ │
│ │ ▼
│ │ [Calendar DLP Processor]
│ │ (Scans Title/Loc/Desc)
│ │ │
▼ ▼ ▼
┌───────────────────────────────────────────────────────────┐
│ "Ask Gemini in Drive" Core Interface │
│ - Resolves context across Gmail and files │
│ - Generates unified summaries under secure compliance │
└───────────────────────────────────────────────────────────┘
Technical Architecture Spotlight: Gemini 3.1 Pro Deep Think Agentic Integration Pipeline
This architecture shows how Gemini 3.1 Pro is deployed in preview to handle complex reasoning tasks, synthesize wide-context course files, and execute multi-step agentic workflows:
[Master Course Source Repository] ──> [Gemini 3.1 Pro Reasoning Engine]
Technical Architecture Spotlight: The Scholarly SSoT Reference Sync Pipeline
[Paperpile Cloud Library] ──(LTI 1.3 / API)──> [Canvas LMS Course View]
│ │
│ (Live Document Sync) │ (Citations/Metadata)
▼ ▼
[Google Docs (Curriculum Source)] ─────────> [NotebookLM Grounded Context]
│ │
└──────────────────(Verified Bibliography)──┘
│
Technical Architecture Spotlight: NotebookLM MCP CLI & Local IDE Compilation Pipeline
This architecture maps how version-controlled, local Markdown curriculum files are compiled and pushed to a secure, grounded NotebookLM environment programmatically using an MCP Server and Command-Line Interface (CLI):
[Local IDE (VS Code / Antigravity)] ──(CLI Commands / MCP Tool Calls)──> [notebooklm-mcp-cli Server]
│
▼
[Local Markdown Files (CaC Sources)] ───────────────────────────────> [Programmatic Ingestion Layer]
│
▼
[VPC-SC Secured Environment] ───────────────────────────────────────> [Secure NotebookLM Workspace]
│ (Grounded Outputs)
▼
[Local Workspace Integration]
July 16, 2026 — Real-Time Group Chat Collaboration, Custom Generative Email Refinement, and Active Session Invalidation
On this date, the continuous research monitor captured critical general availability releases in Google Workspace’s real-time communication stack, generative writing assistants, and enterprise directory security (released July 14 and 15, 2026). These represent the acceleration of ad-hoc multi-tenant communication under Curriculum as a Service (CaaS) and the technical hardening of access control and credential lifecycle management under Curriculum as Code (CaC).
Group Conversations with External Collaborators in Google Chat (GA July 15, 2026)
Classification: Curriculum as a Service / Multi-Tenant Real-Time Collaboration
Key Mechanism: Google Chat now supports creating group conversations that include external members Now available: group conversations with external collaborators in Google Chat. Previously, external users were restricted to 1:1 direct messages or structured "Spaces." Group conversations can now be spun up instantly across domain boundaries.
Impact on CaaS: Removes administrative friction for hybrid programs. For multi-institutional clinical rotations, corporate training partnerships, or agricultural outreach cohorts, instructors and external supervisors can instantly spin up secure, ad-hoc chat channels without the administrative burden of setting up formal spaces or sending slow, asynchronous emails.
Custom Prompt-Based Refinement in Gmail "Help me write" (GA July 14, 2026)
Classification: Curriculum as a Service / Interactive Content Generation & Refinement
Key Mechanism: Gmail’s generative "Help me write" assistant now features an interactive prompt bar for custom draft revisions New refinement capabilities allow custom editing with Help me write in Gmail. Instead of using static presets (e.g., Polish, Formalize, Shorten), users can write a precise, context-aware prompt (such as "reformat this assignment as a numbered bullet list with bold action headings") to iteratively edit email drafts.
Impact on CaaS: Standardizes a dynamic, prompt-editable learning support assistant. Program coordinators and mentors can write precise, natural-language prompts to iteratively refine, localize, and structure student-facing announcements, syllabus updates, or grading feedback directly within their email client, maintaining pedagogical alignment with zero manual drafting overhead.
Instant Account Deprovisioning in Google Workspace (GA July 11, 2026 / Rollout July 9, 2026)
Classification: Curriculum as Code / Infrastructure Security & Access Governance
Key Mechanism: Google has deployed native, immediate session deprovisioning across the Workspace ecosystem Google Workspace Instant Deprovisioning Update - OzComm. When an administrator suspends or removes an account, active OAuth 2.0 session tokens, Gmail/Drive mobile credentials, and browser session cookies are invalidated in real-time, instantly cutting off file and communication access rather than waiting for background directory synchronization delays.
Impact on CaC: Hardens data sovereignty and intellectual property boundaries. In highly regulated educational and clinical environments, this ensures that departed staff, completed student cohorts, or compromised credentials immediately lose access to curriculum SSoT directories, shared drives, and active LMS LTI interfaces, preventing data leaks or unauthorized grade book alterations.
├─► [Synthesized Multi-Source Analysis]
├─► [Grounded Visual Explanations]
└─► [Ambitious Agentic Workflows]
Technical Architecture Spotlight: Google Workspace Instant Deprovisioning and Active Token Invalidation Pipeline
This architecture maps how an administrator suspend action instantly triggers real-time OAuth 2.0 token and browser session invalidation, immediately cutting off access to curriculum source folders and cloud-based LMS integrations to prevent unauthorized access or data exfiltration:
[Google Admin Console (Identity Lifecycle Change)]
│
▼ (Real-Time Invalidation Event)
[Google Identity Provider (IDP) Core Service] ────┬────► [Active OAuth 2.0 & LTI Session Tokens Rejected]
│
├────► [Immediate Browser Cookie Expiration (TPM Bound)]
│
▼ (Access Denied)
[Secure Cloud Drive SSoT (CaC)]
│
▼ (Immediate Disconnect)
[Hardened LMS Integrations / Student Sandboxes (CaaS)]