Patrick Bass Area: mobieusLearn (audit p8) · Surface: mobieusLearn admin — LTI 1.3 platforms (/learn/lti-platforms, deep-linking, NRPS sync, score postbacks) · Dimension: documentation · Severity: minor
LTI 1.3 (registering Mobieus as a launch tool inside an external LMS, with deep-linking content selection, Names-and-Roles roster sync, and Assignment-and-Grade score postbacks) shipped in Phase 3 but has no dedicated documentation. The admin guide names the feature and one external-config step but omits the actual integration procedure: provisioning the Ed25519/RSA keypair (the /keygen route), JWKS/issuer/client-id exchange, deep-linking setup, NRPS sync, and reading the score-postbacks log. Configuring LTI is one of the highest-friction LMS tasks and currently has no runbook on the wiki.
Evidence
LTI 1.3 is a complex multi-surface integration: LearnLtiAdminController (/learn/lti-platforms, /lti-platforms/keygen, /{id}/nrps-sync, /{id}/score-postbacks) plus deep-linking templates (learn/lti/deep-linking-catalog.php, deep-linking-response.php). No dedicated wiki article exists: no LTI slug in the /know/index slug list, and direct probes 404 (`/know/learn-lti` → 404, `/know/mobieuslearn-lti` → 404). Coverage is limited to a few sentences in the admin overview: `curl -s /know/mobieuslearn-admin-guide | strip | grep -i lti` → 'LTI 1.3 (/admin/learn/lti-platforms) — register external LMS platforms (Canvas, Brightspace, Moodle, Blackboard, Schoology) as launch sources' and 'In the external LMS, register Mobieus as a new LTI 1.3 tool' — with no mention of keypair provisioning, the deep-linking catalog flow, NRPS roster sync, or AGS score postbacks, all of which have their own admin routes/UI.Suggested fix. Write a /know/learn-lti (or mobieuslearn-lti) article walking through keypair provisioning, the platform registration exchange (issuer/client-id/JWKS/redirect URIs), deep-linking, NRPS roster sync, and AGS score postbacks; link from the admin guide Related articles.
Filed by the automated tenant-app audit and adversarially evidence-verified. Status: verified. Open — not yet actioned.
Patrick Bass
@mobieus
