[New] mobieusLearn: No assessment integrity controls — proctoring, access code, IP restriction, or availability window

Area: mobieusLearn (audit p8) · Surface: learn_assessments schema · Dimension: competitor-gap · Severity: major

Moodle and LearnWorlds offer quiz availability windows (open/close datetime), require-access-password, IP/network restriction, and proctoring integrations; certification programs require at least one of these. mobieusLearn has timing and attempt caps but no way to (a) open a quiz only during an exam window, (b) require an access code, (c) restrict to a network, or (d) any proctoring hook. Why it matters: blocks any tenant selling proctored certifications or compliance exams — a core paid-LMS use case the product already targets via certificates + CE credit.

Evidence

database/migrations/2026-06-01-learn-phase1.sql learn_assessments columns: only `max_attempts`, `time_limit_seconds`, `scoring_method`, `pass_mark_pct`, `feedback_timing`, `review_rule`, `shuffle_items`, `shuffle_options`. No `open_at`/`close_at`/availability window (grep returns nothing). grep for `proctor|lockdown|webcam|access_code|ip_restrict` across src+migrations finds only a doc-comment in Pool.php:16 ('full proctoring') and unrelated SCIM 'honor' matches — no implementation.

Suggested fix. Add `available_from`/`available_until` and `access_code` columns to learn_assessments enforced in AttemptService::start(); expose an optional proctoring webhook/integration point for tenants that need it.

Filed by the automated tenant-app audit and adversarially evidence-verified. Status: verified. Open — not yet actioned.