--- title: "Week of April 24 – May 1, 2026" slug: "platform-update-2026-05-01" date: "2026-05-01" tag: "Application" summary: "AI grading with weighted rubrics, student demographics system, video generation via Google Veo, mentor-scoped API restructuring, and MCP content sanitization." author: "ibl.ai Engineering" --- *Weekly technical summary of new agentic and enterprise capabilities.* ## Frontend ### UI Components - **Agent Search & Discovery Architecture** — Complete migration of agent tabs, search interface, and discovery components to web-containers SDK. New `AgentCard` component with starring functionality, `AgentSearchFilters` with multi-faceted filtering, and sectioned layout (custom, default, featured, starred agents). Full test coverage with 35+ new test files. Components: `AgentCard`, `AgentSearchInput`, `AgentSearchFilters`, `AgentEmptyState`, plus dedicated sections for each agent type with pagination support. - **Course Content Discovery Components** — Skills discover page sub-components migrated to SDK including `DiscoverContentCard`, `DiscoverFacetsFilter`, `AccessiblePaginate`, and `DiscoverFilterDrawer` with complete test coverage. New `useDiscover` hook with 330+ lines of test coverage for faceted search and pagination logic. - **Enhanced Audit Log Interface** — Humanized field names with explicit label mapping, directional verbs for boolean toggles, preserved mentor unique IDs for disambiguation, and defensive fallbacks for unmapped fields. Client-side filtering safety net prevents audit log action leakage when backend filters fail. ### Data Layer - **Paginated Mentor Memories API** — New `useGetMentorMemoriesListQuery` endpoint backed by `/mentor-memories-list/` with filtering by category, user, date range, and ownership. Supports `page`, `page_size`, `category`, `my_memory`, `user_id`, `email`, `start_date`, `end_date` parameters. - **Cross-Frame Communication** — Proactive messaging via PostMessage API for seamless unit switching on skills platform, enabling silent context messages between iframe and parent application. EventBus extension with new message handlers for cross-frame state synchronization. ## Backend ### AI Grading System - **Submission-Based Grading Architecture** — Complete AI grading system with `MentorGraderConfiguration` and `GraderCriterion` models. Configurable weighted rubric with strict validation, inner LLM service for rubric evaluation, and `GradeResult` persistence with optional LMS publishing. New Grading langchain toolkit with `grade_submission` tool, edX integration, `silent_to_user` tool flag support. - **Grader Configuration CRUD API** — Admin endpoints for managing grader configurations at `/mentors/{uuid}/grader-config/` and criteria at `/mentors/{uuid}/grader-config/criteria/`. Three-mode feedback system (`overall` / `per_criteria` / `both`) with runtime validation. RBAC enforcement via mentor-rooted resource paths, paginated criteria endpoints with search capability. ### Data Model - **Student Demographics System** — Comprehensive demographics with built-in fields (gender, ethnicity, DOB, language, nationality, disability) plus platform-specific custom fields (text, number, date, boolean, select). REST API with bulk export/import as JSON or CSV. Models: `UserDemographics`, `DemographicsFieldDefinition`, `UserDemographicsCustomValue` with validation service layer. - **Memory System Optimization** — Legacy memory system removal, paginated `/mentor-memories-list/` endpoint, and exclusive memsearch approach via `abuild_system_prompt()`. Tenant memory enabled by default. Fixes `AttributeError` in mentor consumer chat, handles timeout issues on mentors with extensive memory histories. ### API Changes - **Mentor-Scoped API Restructuring** — Flat endpoints replaced with nested UUID-addressed surfaces: `/orgs/{org}/mentors/{uuid}/agent-config/`, `/claw-config/`, `/skills/`. `AgentSkill.unique_id` UUIDField for symmetric skill references. Tenant isolation via `resolve_mentor_for_tenant()`, Django UUID converter validation, RBAC resource path updates. - **File Upload Context** — System prompts now include an "Uploaded Files:" section with names and URLs when users upload files in chat, enabling LLM file location references. Integration with chat message flow and URL generation service. ### Security Capabilities - **Authentication Header Protection** — Structural redaction of `Authorization` and sibling auth headers (`X-Api-Key`, `X-Auth-Token`, `Api-Key`) in tool-call display. Headers collapse to uniform markers before token-shape regex processing. Context-based extractor for header patterns, basic-auth shorthand, SHA-256-shape token detection with entropy guards. - **MCP Content Sanitization** — Zero-trust `MCPContentSanitizer` for all MCP tool outputs. HTML tag stripping via Django's `strip_tags()`, content wrapped with instruction-separation markers. New utility module `ibl_ai_mentor/utils/mcp_security.py` with prompt injection defense. ## Infrastructure ### Platform Services - **Rate Limiting Framework** — Per-tenant hourly rate limiting for image and video generation (default 10/hour each). Configurable limits via admin/platform API, tool removal when quota exhausted, WebSocket warning messages. Django cache-based usage tracking, tenant-specific quota overrides, zero-limit disable option. - **Video Generation Tool** — Google Veo integration for LangChain agents with `VideoGenerationTool`. `VeoVideo` model with markdown representation, Vertex AI and Gemini Developer API support. Streaming and final-response paths, `video.partial` WebSocket events, Langfuse cost reporting via `cost_details`. - **Notification System Enhancement** — Free-form template tagging with OR-logic filtering via `?tags=` parameter. Distinct tags endpoint for autocomplete, optional pagination on template lists, course milestone notification debouncing. JSONField validation, 60-second debounce with cache lock, single email for highest milestone reached. ### HQ SPA Integration - **HQ SPA Integration** — New `ibl-hq-spa-pro` service served at `/hq` subpath under auth domain. Complete compose configuration, environment files, and reverse proxy upstream integration. Port 5004, Next.js `basePath: '/hq'`, wired into `spa.conf` with `hq_spa` upstream definition. - **Configurable Upload Limits** — Service-level `CLIENT_MAX_BODY_SIZE` configuration for reverse proxy apps. Templated via `IBL_REVERSE_PROXY` settings preserving existing defaults (250M, 25M, 2M, 1M). Affects `ibl_dm_pro`, `ibl_status_pro`, `cms`, `lms`, `mfe`, `meilisearch`, `monitor`, `notes`, `spa_flags`, `status`, `unified_api`. ### DevOps Automation - **Client Repository Sync Workflow** — GitHub Actions workflow for syncing tagged CLI versions to client monorepos with artifact stripping (`.git/`, `.github/`, `.claude/`, `*.md` except README). Guard file verification, force-push protection, dry-run capability, fine-grained PAT security. - **Monorepo Support** — Infrastructure CLI supports `repo/subdir` form for `cli-ops` and `prod-images` installs from client monorepos via subdirectory parameter in pip URLs. `parse_repo_path()` function, Ansible extra-vars flow, backward-compatible bare repo handling. ## Documentation - **Skill Documentation Consolidation** — Single reference `skill-setup.md` for consistent skill configuration across all `iblai-*` skills. Standardized API documentation format for analytics, notification, and agent-memory skills. Centralized setup instructions with per-skill references, comprehensive API endpoint documentation. See [Skills Setup](https://ibl.ai/docs/platform/skills/). - **MCP Documentation Update** — Updated Model Context Protocol documentation in `iblai-agent-tool` skill with current implementation details and usage patterns. Technical implementation guidance for MCP server configuration and tool integration. See [MCP Documentation](https://ibl.ai/docs/platform/mcp/). ## REST API Changelog (iblai-dm-pro) *Schema version: 4.234.0-ai-plus → 4.243.1-ai-plus* ### 🆕 New Endpoints - `GET/PATCH /api/ai-mentor/orgs/{org}/mentors/{mentor_unique_id}/agent-config/` — Mentor-scoped agent configuration management - `GET/PATCH/DELETE /api/ai-mentor/orgs/{org}/mentors/{mentor_unique_id}/claw-config/` — Mentor-scoped Claw configuration - `POST /api/ai-mentor/orgs/{org}/mentors/{mentor_unique_id}/claw-config/push-config/` — Push Claw configuration action - `GET/POST /api/ai-mentor/orgs/{org}/mentors/{mentor_unique_id}/skills/` — Mentor skill assignment collection - `GET/PUT/PATCH/DELETE /api/ai-mentor/orgs/{org}/mentors/{mentor_unique_id}/skills/{assignment_pk}/` — Individual skill assignment management - `GET /api/ai-mentor/orgs/{org}/users/{user_id}/mentors/{mentor_id}/mentor-memories-list/` — Paginated mentor memories with filtering - `GET /api/notification/v1/platforms/{platform_key}/templates/tags/` — Distinct notification template tags for autocomplete ### 🗑️ Removed Endpoints - `/api/ai-mentor/orgs/{org}/agent-configs/` and `/{id}/` — Replaced by mentor-scoped endpoints - `/api/ai-mentor/orgs/{org}/claw/mentor-configs/` and `/{id}/` — Replaced by mentor-scoped endpoints - `/api/ai-mentor/orgs/{org}/claw/mentor-configs/{id}/push-config/` — Moved to mentor-scoped structure - `/api/ai-mentor/orgs/{org}/mentor-skill-assignments/` and `/{id}/` — Replaced by mentor-scoped skills endpoints