# Building Blocks and Standards for a New Self-Hostable Course Platform (state as of Oct 2026)

Method note: Budget was about 15 tool calls. Items marked **[verified 2026-10]** were checked against a live source in this session. Items marked **[unverified, pre-2026 knowledge]** cite the canonical primary URL but were NOT re-fetched this session. The report writer should treat those as likely-but-unconfirmed and flag them.

## 1. E-learning standards status (SCORM, xAPI/IEEE 9274.1.1, cmi5, LTI 1.3/Advantage, QTI 3, Common Cartridge, Open Badges 3.0/CLR 2.0, CASE): which matter for purchased content and university integration?

### Takeaway
SCORM 1.2/2004 is frozen but is still the main format for off-the-shelf content libraries, so a platform that imports purchased content must run it. xAPI is now a formal IEEE standard (9274.1.1-2023, "xAPI 2.0"), and cmi5 is the modern packaging/launch profile on top of it. LTI 1.3/Advantage is required for university LMS integration, and Blackboard is retiring LTI 1.0/1.1 (LTI 1.3 required by 30 Sep 2027). Open Badges 3.0 and CLR 2.0 (W3C Verifiable Credentials) are the credential standards to target. QTI 3.0 and Common Cartridge are lower priority except for university course exchange.

### Cited Findings
- **xAPI / IEEE 9274.1.1-2023 [verified 2026-10]:** The IEEE board approved it on 2023-03-30 and published it on 2023-10-06. It is listed as an "Active Standard" under the Apache-2.0 open-source license. It specifies a JSON data model and a REST API between activities and a Learning Record Store (LRS). — [IEEE SA 9274.1.1](https://standards.ieee.org/ieee/9274.1.1/7321)
- ADL calls it the first open-source standard in IEEE history and says it became a standard via IEEE LTSC on 10 Oct 2023. — [ADL news, Nov 2023](https://adlnet.gov/news/2023/11/22/xAPI-Officially-Becomes-a-Published-IEEE-Standard)
- In xAPI 2.0, several "strong recommendations" from 1.0.3 became requirements, and the text was edited for clarity. Vendors need to prepare for 2.0 separately from 1.0.3. — [xapi.com (Rustici) blog](https://xapi.com/blog/what-vendors-can-do-to-prepare-for-xapi-2-0)
- The IEEE page also references a 2025 ISO/IEC/IEEE edition (39274-1-1-2025). This was not independently verified. — [IEEE SA 9274.1.1](https://standards.ieee.org/ieee/9274.1.1/7321)
- **cmi5:** ADL released the production "Quartz" version of cmi5 after the developer-validation "Sandstone" version. This release is from about 2016; I found no newer ADL cmi5 release in the search. — [Learning Guild](https://www.learningguild.com/articles/adl-cmi5-committee-announces-release-of-quartz-version-of-cmi5-specification)
- Rustici added cmi5 to SCORM Cloud, SCORM Engine and SCORM Driver. iSpring publishes cmi5. Some authoring tools (for example, ActivePresenter in an older forum post) did not. This shows that cmi5 authoring support is common in major tools but not universal. — [Rustici](https://rusticisoftware.com/?p=21736); [iSpring](https://www.ispringsolutions.com/blog/?p=9069); [Atomi forum](https://talk.atomisystems.com/t/support-for-cmi5/3154)
- **LTI 1.3 [verified 2026-10]:** Blackboard is retiring LTI 1.0/1.1 and requires LTI 1.3 by 30 Sep 2027. New registrations tighten from 1 Jan 2027. Canvas tools are migrating to LTI 1.3 (May 2025 note). — [Blackboard community](https://community.blackboard.com/home/blogs/retirement-of-lti-11-support-in-blackboard-lms-2026-08-27); [Canvas community](https://community.canvaslms.com/t5/The-Product-Blog/Update-your-Impact-Course-Reports-to-the-LTI-1-3-version/ba-p/581663)
- **QTI 3.0:** Released in May 2022 and still the latest version; I found no later release. — [1EdTech QTI versions](https://www.1edtech.org/standards/qti/versions); [1EdTech blog "Finally Final: QTI 3.0"](https://www.1edtech.org/blog/finally-final-the-qti-30-release)
- **Common Cartridge 1.4:** Listed by 1EdTech as "Candidate Final" and ready to implement. Its K-12 profile bundles LTI 1.3 and QTI 3.0. The status is undated. — [1EdTech Common Cartridge](https://1edtech.org/standards/cc)
- **Open Badges 3.0:** Approved as a final 1EdTech spec in June 2024. This date comes from a secondary source, and 1EdTech's own page was not fetched. — [POK guide (secondary)](https://www.pok.tech/blog/posts/open-badge-3-0-complete-guide-digital-credentials)
- 1EdTech says OB 3.0 and CLR 2.0 are "native verifiable credentials, as defined by the W3C." — [1EdTech CLR FAQ](https://1edtech.org/clr/faq)
- CLR 2.0 bundles multiple achievements into one signed ClrCredential aligned with OB 3.0. One secondary source dates its release to March 2025. — [Forasoft (secondary)](https://www.forasoft.com/learn/elearning-video/articles-elearning/certificates-badges-verifiable-credentials)
- 1EdTech runs an OB 3.0 conformance and certification program for both issuers and hosts/displayers. Certification requires more than the spec strictly mandates. — [1EdTech OB 3.0 Cert Guide](https://standards.1edtech.org/open-badges/specifications/standards/v3p0/cert)
- **CASE:** The 1EdTech Competencies and Academic Standards Exchange spec is used for machine-readable competency frameworks. — [1EdTech standards roadmap](https://www.1edtech.org/standards/roadmap) [unverified, pre-2026 knowledge for CASE details]

### Inferences
- **Importing purchased content:** You need SCORM 1.2 plus SCORM 2004 (3rd/4th ed.) runtime as the floor. Most content libraries also offer LTI 1.3 delivery, where the vendor hosts the content, and some offer cmi5/xAPI. An LTI 1.3 *platform* (consumer) role is therefore as important as the SCORM player for B2B content. AICC is legacy and can likely be skipped. Note that scorm-again v3 dropped AICC.
- **University integration:** The new platform should act as an LTI 1.3 *tool*, so universities can embed courses in Canvas, Moodle, Blackboard or Brightspace. It needs Advantage services: Names and Roles Provisioning Services (NRPS), Assignment and Grade Services (AGS), and Deep Linking. Common Cartridge export is a nice-to-have, and QTI 3 import/export matters only for assessment portability.
- **Credentials:** Target OB 3.0 (and optionally CLR 2.0) issuance from the start. OB 2.0 is legacy, and OB 3.0 is a different data model (VC-based), so retrofitting later is costly.
- **Analytics:** Emit xAPI statements internally, for example to an embedded LRS, so the platform can satisfy cmi5 and enterprise analytics requests.

### Gaps
- I could not confirm the official 1EdTech dates for OB 3.0 final and CLR 2.0 final from 1EdTech pages directly, only from secondary sources.
- I found no 2025–2026 change to cmi5 or SCORM. I also could not verify whether ADL has moved cmi5 into IEEE (an IEEE P9274.x cmi5 work item has been discussed historically).
- The 2025 ISO/IEC/IEEE 39274-1-1 edition is unverified.
- LTI Advantage service versions and any "LTI 1.3 + Dynamic Registration" adoption status were not checked this session.

## 2. OSS runtimes and libraries: SCORM players, cmi5 players, LRSs, LTI libraries, QTI tools, Open Badges issuers

### Takeaway
The building blocks are uneven. scorm-again (MIT) is a solid SCORM 1.2/2004 runtime with sequencing, but it has no cmi5/xAPI. LRS options exist: Yet Analytics SQL LRS (Apache-2.0), plus Learning Locker (GPL-3.0, still public but apparently low-activity). LTI libraries exist for Node, Python and PHP. OB 3.0 open-source issuers are immature, and Badgr's OB 3.0 support is only partial.

### Cited Findings
- **scorm-again [verified 2026-10]:**
  - License and scope: MIT. Supports SCORM 1.2 and SCORM 2004, including a "complete implementation" of IMS Simple Sequencing (navigation requests, rollup and sequencing rules) in v3.0.0.
  - Dropped and missing standards: AICC was removed in v3.0.0. cmi5/xAPI are *not* supported and are listed only as "potential" roadmap items.
  - Offline: offline support is a v3 feature still under development.
  - Source: [GitHub jcputney/scorm-again](https://github.com/jcputney/scorm-again)
- **Learning Locker [verified 2026-10]:**
  - Status and license: the GitHub repo is not archived and is GPL-3.0. Its README points to the commercial "Learning Locker Data Cloud". Releases and packages are empty, and no deprecation notice is shown.
  - Activity: 3,254 commits, 72 open issues, 6 open PRs.
  - Source: [GitHub LearningLocker/learninglocker](https://github.com/LearningLocker/learninglocker)
- Learning Locker v2 (Sept 2017) was ADL-certified as xAPI-conformant and moved from PHP to Node.js. The newest Learning Pool open-source news I found dates from 2019. — [Learning Pool v2 announcement](https://learningpool.com/learning-locker-open-source-v2-is-here/); [Learning Pool "A New Direction"](https://learningpool.com/blog/learning-locker-a-new-direction)
- **Badgr:** Badgr is described as a free and open-source Open Badges platform. A third-party comparison (July 2026) lists Badgr's open-educational-badges as covering OB 1.1, 2.0 and 3.0, but with *partial* issue/verify support. **edubadges** is a maintained open-source fork of Badgr. Open edX's Teak/Ulmo releases document badging and verifiable-credential options. — [Canvas Badgr overview](https://learn.canvas.net/courses/2739/modules/items/239349); [Open edX forum](https://discuss.openedx.org/t/common-questions-about-badging-and-verifiable-credentials-in-open-edx-teak-ulmo/18434)
- **Yet Analytics SQL LRS** (Apache-2.0, Postgres/SQLite, xAPI 1.0.3 and 2.0 conformance claimed) — [GitHub yetanalytics/lrsql](https://github.com/yetanalytics/lrsql) [unverified, pre-2026 knowledge]
- **TRAX LRS** (Laravel/PHP; open-source edition, commercial "extended") — [traxlrs.com](https://traxlrs.com) [unverified, pre-2026 knowledge]
- **Veracity Learning** LRS has a free/community tier but is not open source. — [lrs.io](https://lrs.io) [unverified, pre-2026 knowledge]
- **ADL open-source cmi5 tooling:** the ADL "CATAPULT" project provides a cmi5 player prototype and a conformance test suite (Apache-2.0). — [GitHub adlnet/CATAPULT](https://github.com/adlnet/CATAPULT) [unverified, pre-2026 knowledge]
- **Pipwerks SCORM API wrapper** is the *content-side* wrapper, not an LMS runtime. It is MIT-licensed and old but stable. — [GitHub pipwerks/scorm-api-wrapper](https://github.com/pipwerks/scorm-api-wrapper) [unverified, pre-2026 knowledge]
- **LTI libraries** [unverified, pre-2026 knowledge]:
  - **ltijs** (Node, Apache-2.0, tool side; maintenance has historically been single-maintainer) — [GitHub Cvmcosta/ltijs](https://github.com/Cvmcosta/ltijs)
  - **pylti1.3** (Python, MIT, tool side; Django/Flask adapters) — [GitHub dmitry-viskov/pylti1.3](https://github.com/dmitry-viskov/pylti1.3)
  - **1EdTech/packbackbooks lti-1-3-php-library** (PHP, tool side) — [GitHub packbackbooks/lti-1-3-php-library](https://github.com/packbackbooks/lti-1-3-php-library)
  - Platform-side (consumer) OSS libraries are scarcer. Moodle's and Open edX's code is the main reference.
- **QTI tooling** [unverified, pre-2026 knowledge]: the TAO platform (OAT, GPL-2.0) is the main open-source QTI engine. 1EdTech publishes QTI 3 examples and validators to members. — [TAO](https://www.taotesting.com)

### Inferences
- **SCORM path:** scorm-again covers the "play purchased SCORM" requirement in the browser. The team must still build the backend: package import, manifest parsing, the CMI data store, and ideally sequencing persistence.
- **cmi5 path:** cmi5 requires building launch and session logic on top of an LRS, using ADL CATAPULT as a reference and test suite. Rustici Engine is the only turnkey all-standards engine, and it is commercial.
- **Licenses:** SQL LRS (Apache-2.0) is the lowest-risk embeddable LRS. Learning Locker is GPL-3.0 and appears effectively commercial-first, so it is a weaker bet.
- **Badges:** An OB 3.0 issuer is probably a build item (VC signing plus JSON-LD context plus 1EdTech certification), possibly using generic W3C VC libraries.

### Gaps
- I did not verify scorm-again's latest version or release date, or the activity of ltijs and pylti1.3 in 2025–2026.
- I did not verify SQL LRS's current version or license, TRAX's status, or whether Learning Locker has had commits since 2023.
- Badgr's current corporate owner and status (it was acquired by Instructure in 2021) and its open-source repo activity were not checked this session.
- I found no mature open-source OB 3.0 issuer confirmed this session.

## 3. Video pipeline: transcoding/HLS/DASH, players, captions (Whisper), DRM, S3-compatible storage (MinIO changes, Garage, SeaweedFS)

### Takeaway
The storage landscape changed sharply. MinIO's community repo was archived on 25 Apr 2026 and is no longer maintained; it went source-only in Oct 2025. New builds should therefore use Garage (AGPLv3), SeaweedFS, Ceph RGW or a community fork. The transcode/packaging/player stack (FFmpeg + Shaka Packager + Shaka/Video.js/Vidstack) is mature OSS. DRM cannot be fully open source, because Widevine, PlayReady and FairPlay need vendor licenses and CDMs; only ClearKey/AES-128 HLS is open.

### Cited Findings
- **MinIO [verified 2026-10]:**
  - Repo status: the GitHub repo was "archived by the owner on Apr 25, 2026". The README says "THIS REPOSITORY IS NO LONGER MAINTAINED".
  - License and distribution: source is AGPLv3. "The MinIO community edition is now distributed as source code only", and legacy binaries "will not receive updates".
  - Alternatives MinIO points to: AIStor Free (standalone, free license) and AIStor Enterprise.
  - Source: [GitHub minio/minio](https://github.com/minio/minio)
- MinIO timeline per secondary sources:
  - Console removed from the community edition in 2025 (sources disagree whether February or May).
  - Docker images and binaries stopped in Oct 2025.
  - README moved to maintenance mode on 3 Dec 2025.
  - Marked "no longer maintained" in Feb 2026.
  - A fork, pgsty/minio, restores the console and binaries.
  - Sources: [vonng blog](https://blog.vonng.com/en/db/minio-resurrect/); [It's FOSS](https://itsfoss.com/news/minio-moves-away-from-open-source/); [Elest.io](https://blog.elest.io/minio-is-in-maintenance-mode-your-guide-to-s3-compatible-storage-alternatives/)
  - Conflict: one source cites Feb 2026 archival, but GitHub shows an archive date of 25 Apr 2026. I treat the GitHub banner as authoritative for the final archive date.
- **Garage:**
  - What it is: an AGPLv3 S3-compatible store for small, geo-distributed self-hosted deployments, run in production by Deuxfleurs since 2020. The crate is at v2.4.x on docs.rs.
  - Maintainers' view on AGPL: if Garage could be swapped for another S3 store, the result is an "aggregate of independent works" and not subject to the license restriction. This is not legal advice.
  - Sources: [GitHub deuxfleurs-org/garage](https://github.com/deuxfleurs-org/garage); [Garage issue #840](https://git.deuxfleurs.fr/Deuxfleurs/garage/issues/840); [docs.rs garage 2.4.1](https://docs.rs/crate/garage/2.4.1)
- **SeaweedFS** (Apache-2.0, S3 gateway, good for many small files) — [GitHub seaweedfs/seaweedfs](https://github.com/seaweedfs/seaweedfs) [unverified, pre-2026 knowledge]
- **Ceph RGW** (LGPL; heavy but proven at university scale) — [ceph.io](https://ceph.io) [unverified, pre-2026 knowledge]
- **Transcoding and packaging** [unverified, pre-2026 knowledge]:
  - FFmpeg (LGPL/GPL depending on build flags) — [ffmpeg.org legal](https://ffmpeg.org/legal.html)
  - Shaka Packager (BSD-3, HLS/DASH/CMAF plus CENC encryption) — [GitHub shaka-project/shaka-packager](https://github.com/shaka-project/shaka-packager)
- **Players** [unverified, pre-2026 knowledge]:
  - Shaka Player (Apache-2.0, DASH/HLS plus EME DRM) — [GitHub shaka-project/shaka-player](https://github.com/shaka-project/shaka-player)
  - Video.js (Apache-2.0; v10 is merging with Vidstack/Plyr/Media Chrome efforts) — [videojs.com](https://videojs.com)
  - Vidstack (MIT) — [vidstack.io](https://www.vidstack.io)
  - hls.js (Apache-2.0) — [GitHub video-dev/hls.js](https://github.com/video-dev/hls.js)
- **PeerTube** as a video backend (AGPLv3; HLS transcoding, runners for remote transcoding, plugin API; built-in Whisper-based automatic transcription since v6.2/v7) — [joinpeertube.org](https://joinpeertube.org); [GitHub Chocobozzz/PeerTube](https://github.com/Chocobozzz/PeerTube) [unverified, pre-2026 knowledge]
- **Captions** [unverified, pre-2026 knowledge]:
  - OpenAI Whisper (MIT, weights MIT) — [GitHub openai/whisper](https://github.com/openai/whisper)
  - faster-whisper (MIT, CTranslate2) — [GitHub SYSTRAN/faster-whisper](https://github.com/SYSTRAN/faster-whisper)
  - whisper.cpp (MIT) — [GitHub ggml-org/whisper.cpp](https://github.com/ggml-org/whisper.cpp)
- **DRM** [unverified, pre-2026 knowledge]:
  - Widevine requires a license agreement with Google, FairPlay requires Apple's FPS deployment package, and PlayReady requires a Microsoft license.
  - Open-source *packaging* (Shaka Packager) and *players* (Shaka, Video.js plus EME) exist, but the key/license server and CDM are proprietary or licensed.
  - Sources: [Widevine](https://www.widevine.com); [Apple FairPlay Streaming](https://developer.apple.com/streaming/fps/)

### Inferences
- **DRM need:** For a course platform, DRM is usually overkill except for licensed third-party video. Most self-hosted platforms use signed URLs, short-lived tokens, AES-128 HLS and watermarking, all of which are fully open.
- **Storage choice:**
  - Garage: AGPL, simple, multi-site, suits homelab users.
  - SeaweedFS: Apache-2.0, performant.
  - Ceph: enterprise and university scale.
  - Design for "any S3" and do not bundle MinIO.
- **Build vs. reuse:** PeerTube can serve as a turnkey transcode and stream backend (its runners and transcription are reusable), but it is AGPL and federated-video-oriented. A thin custom FFmpeg/Shaka pipeline may fit better if you need multi-tenant access control.

### Gaps
- I did not verify SeaweedFS's license, PeerTube's 2026 version and transcription features, or the Video.js v10/Vidstack merger status this session.
- The current AIStor Free license terms were not examined.
- No open-source multi-DRM license server of production quality was confirmed. Some exist for ClearKey only.

## 4. Auth and identity: Keycloak, Authentik, Zitadel, Ory, Authelia (OIDC/SAML/SCIM, eduGAIN/Shibboleth)

### Takeaway
No source was fetched this session; all items are from pre-2026 knowledge. For universities, SAML 2.0 SP support with metadata-aggregate (eduGAIN/InCommon) ingestion is the key requirement. Keycloak (CNCF, Apache-2.0) is the safest default. Authentik and Zitadel are viable for SAML and OIDC. Authelia is not an IdP broker for SAML federations.

### Cited Findings
- **Keycloak** [unverified, pre-2026 knowledge]:
  - License and scope: Apache-2.0, a CNCF incubating project. It supports OIDC, SAML 2.0 and identity brokering.
  - Federation: it has no native bulk eduGAIN metadata-aggregate import. Community extensions and SATOSA/Shibboleth proxies are typically used.
  - SCIM: added as an experimental feature in recent releases (26.x).
  - Sources: [keycloak.org](https://www.keycloak.org); [CNCF Keycloak](https://www.cncf.io/projects/keycloak/)
- **Authentik** [unverified, pre-2026 knowledge]: MIT core (with enterprise features under a separate license). Supports OIDC, SAML, LDAP, RADIUS, and SCIM *outbound* provisioning. — [goauthentik.io](https://goauthentik.io)
- **Zitadel** [unverified, pre-2026 knowledge]: relicensed from Apache-2.0 to AGPL-3.0 in 2025 (v3). Multi-tenant "organizations" model with OIDC, SAML and SCIM 2.0 server. — [zitadel.com](https://zitadel.com); [GitHub zitadel/zitadel](https://github.com/zitadel/zitadel)
- **Ory** [unverified, pre-2026 knowledge]: Kratos/Hydra are Apache-2.0. SAML and SCIM are mainly in Ory Network/enterprise, not the OSS core. — [ory.sh](https://www.ory.sh)
- **Authelia** [unverified, pre-2026 knowledge]: Apache-2.0, a forward-auth portal and OIDC provider. It does not do SAML. — [authelia.com](https://www.authelia.com)
- **SATOSA** (GÉANT/IdentityPython, Apache-2.0) is the common SAML-to-OIDC proxy used in R&E federations, and Shibboleth SP is the reference SP. — [GitHub IdentityPython/SATOSA](https://github.com/IdentityPython/SATOSA); [shibboleth.net](https://shibboleth.net)

### Inferences
- **Recommended pattern:** the app speaks only OIDC to an embedded or companion IdP (Keycloak or Zitadel). That IdP handles enterprise SAML/OIDC per tenant, and SATOSA or a Keycloak federation extension handles eduGAIN.
- **Provisioning:** SCIM inbound (an Entra ID/Okta push to the platform) is what companies want for seat management. Verify each candidate's *inbound* SCIM server support.

### Gaps
- Nothing in this section was verified this session, including Zitadel's AGPL change date, Keycloak's SCIM status, and Authentik's SCIM direction.
- Whether any candidate natively consumes eduGAIN metadata aggregates with MDQ in 2026 is unknown.

## 5. Commerce: payments, billing, B2B seat licensing, taxes/VAT

### Takeaway
Use Stripe (or Paddle/Lemon Squeezy as merchant of record) for payments and tax. Open-source billing engines exist: Lago (AGPL-3.0, usage and subscriptions) and Kill Bill (Apache-2.0, subscriptions). Hyperswitch (payment orchestration) is likely Apache-2.0 but unverified. Seat-based B2B licensing (seat pools, assignment, true-ups) is application logic that the team must build.

### Cited Findings
- **Lago:** AGPL-3.0 per its GitHub. Lago's 2022 post says AGPL was chosen to deter commercial forks that do not contribute back. — [GitHub getlago/lago](https://github.com/getlago/lago); [Lago blog](https://getlago.com/blog/open-source-licensing-and-why-lago-chose-agplv3)
- **Kill Bill:** Apache-2.0 (per a third-party listing updated Aug 2026). — [ideaproof Kill Bill](https://ideaproof.io/open-source/project/kill-bill); [killbill.io](https://killbill.io)
- **OpenMeter** (Apache-2.0) and Flexprice (AGPL-3.0) are other OSS billing and metering options. This comes from a vendor-adjacent comparison. — [Flexprice glossary](https://flexprice.io/glossary/open-source-billing)
- **Hyperswitch** (Juspay): open-source payment switch/orchestrator, believed Apache-2.0. — [GitHub juspay/hyperswitch](https://github.com/juspay/hyperswitch) [unverified, pre-2026 knowledge]
- **Stripe Tax and Stripe Billing** support per-seat pricing, VAT/OSS (EU One-Stop-Shop) calculation and invoicing for B2B. — [stripe.com/tax](https://stripe.com/tax) [unverified, pre-2026 knowledge]

### Inferences
- **Self-hosted operators** (homelab, universities) mostly do not need commerce. Make commerce a pluggable module.
- **SaaS operators selling to companies:** Stripe Billing plus Stripe Tax, or a merchant of record for EU VAT simplicity, is far cheaper than self-hosting Lago or Kill Bill, unless usage-based billing (for example, lab hours) becomes core.

### Gaps
- Hyperswitch's license and 2026 status are unverified.
- I found no open-source "B2B seat license manager" component. It is likely a build item.

## 6. Hands-on labs and interactive content (Kasm, code-server, JupyterHub, Coder, Killercoda-like, Firecracker, Instruqt alternatives, H5P)

### Takeaway
Hands-on labs are the hardest differentiator to reuse. Kasm's Community Edition is *not* usable commercially: it is limited to non-commercial use and 5 concurrent sessions. The open-source primitives are code-server, JupyterHub, Coder, Firecracker/Kata/gVisor and ttyd/xterm.js, which the team must orchestrate itself. H5P (GPL-3.0/MIT parts) can be embedded standalone.

### Cited Findings
- **Kasm Workspaces [verified 2026-10]:**
  - Community Edition terms: "free to download and install for testing, non-profits and non-commercial activities", limited to 5 concurrent sessions. The EULA bars revenue-generating business use.
  - Paid tiers: licensed per named user or concurrent session.
  - Sources: [Kasm license docs](https://kasm.com/docs/latest/license.html); [Kasm trust: community edition](https://trust.kasmweb.com/community-edition)
- **code-server** (Coder, MIT) — [GitHub coder/code-server](https://github.com/coder/code-server) [unverified, pre-2026 knowledge]
- **Coder** (AGPL-3.0 core, Terraform-defined workspaces; premium features licensed) — [GitHub coder/coder](https://github.com/coder/coder) [unverified, pre-2026 knowledge]
- **JupyterHub** (BSD-3; Kubernetes via Zero to JupyterHub; widely used at universities; LTI authenticator exists) — [jupyterhub.readthedocs.io](https://jupyterhub.readthedocs.io); [GitHub jupyterhub/ltiauthenticator](https://github.com/jupyterhub/ltiauthenticator) [unverified, pre-2026 knowledge]
- **Firecracker** (AWS, Apache-2.0 microVMs, used by Fly.io and others) — [firecracker-microvm.github.io](https://firecracker-microvm.github.io) [unverified, pre-2026 knowledge]
- **Isolation runtimes:** Kata Containers (Apache-2.0) and gVisor (Apache-2.0) are sandbox runtimes for running untrusted learner workloads on Kubernetes. — [katacontainers.io](https://katacontainers.io); [gvisor.dev](https://gvisor.dev) [unverified, pre-2026 knowledge]
- **Killercoda and Instruqt** are proprietary SaaS. **iximiuz Labs** is likewise proprietary. I found no feature-complete open-source Instruqt equivalent this session.
- **Browser terminal/desktop pieces:** ttyd (MIT), xterm.js (MIT) and Apache Guacamole (Apache-2.0) are the browser terminal/desktop primitives. — [GitHub xtermjs/xterm.js](https://github.com/xtermjs/xterm.js); [guacamole.apache.org](https://guacamole.apache.org) [unverified, pre-2026 knowledge]
- **H5P:**
  - Licensing: the core libraries are mixed MIT/GPL, and many content-type libraries are MIT.
  - Embedding: h5p-standalone (MIT) and Lumi's h5p-nodejs-library (GPL-3.0) allow embedding without Drupal, WordPress or Moodle.
  - Interop: H5P emits xAPI statements.
  - Sources: [h5p.org](https://h5p.org); [GitHub Lumieducation/H5P-Nodejs-library](https://github.com/Lumieducation/H5P-Nodejs-library); [GitHub tunapanda/h5p-standalone](https://github.com/tunapanda/h5p-standalone) [unverified, pre-2026 knowledge]

### Inferences
- **Lab engine:** A Pluralsight-style lab engine (provision, check task completion, tear down, quota) is the largest *build* item. The likely stack is Kubernetes plus Kata/gVisor or Firecracker plus ttyd/xterm.js or code-server, with Guacamole for GUI. Coder or JupyterHub can cover dev-environment and notebook labs directly.
- **Kasm:** using it for a commercial platform requires a paid license.
- **H5P license risk:** the GPL-3.0 node library could matter if the platform is distributed under a non-GPL license.

### Gaps
- Coder's license split (AGPL vs. enterprise) and its 2026 status were not verified.
- H5P library licenses and Lumi's status were not verified this session.
- I did not search for newer OSS lab platforms from 2025–2026.

## 7. Search/recommendations, multi-tenancy patterns, and authoring formats (Markdown/MDX course-as-code, Git-backed)

### Takeaway
Nothing in this section was verified this session. The lightweight search engines Meilisearch and Typesense, or OpenSearch at scale, cover catalog search. Postgres plus pgvector covers semantic recommendations. Course-as-code (Markdown/MDX in Git) is well proven by docs frameworks, but I found no standard course schema, so the team must define one.

### Cited Findings
- **Search engines** [unverified, pre-2026 knowledge]:
  - Meilisearch (MIT community edition; enterprise features under a separate license since v1.x) — [GitHub meilisearch/meilisearch](https://github.com/meilisearch/meilisearch)
  - Typesense (GPL-3.0) — [GitHub typesense/typesense](https://github.com/typesense/typesense)
  - OpenSearch (Apache-2.0, Linux Foundation) — [opensearch.org](https://opensearch.org)
- **pgvector** (PostgreSQL license) for embeddings-based "similar courses" — [GitHub pgvector/pgvector](https://github.com/pgvector/pgvector) [unverified, pre-2026 knowledge]
- **Course-as-code prior art** [unverified, pre-2026 knowledge]:
  - Open edX OLX (XML course export), which is not Markdown — [Open edX OLX docs](https://docs.openedx.org)
  - MDX (MIT) and frameworks such as Astro Starlight and Docusaurus (MIT) — [mdxjs.com](https://mdxjs.com)

### Inferences
- **Multi-tenancy:** the common pattern is a single DB with a tenant_id column plus row-level security in Postgres, optionally with per-tenant IdP realms or organizations (Keycloak realms, Zitadel orgs). Homelab single-tenant and SaaS multi-tenant modes should use the same code path.
- **Content model:** a Git-backed, Markdown/MDX course format (lessons, quizzes as YAML/QTI-lite, lab definitions) is a good differentiator for the homelab and dev audience. Add importers for SCORM, cmi5 and Common Cartridge so bought content still fits.

### Gaps
- Meilisearch's and Typesense's current licenses were not verified this session.
- I did not research existing course-as-code schemas or tools from 2025–2026 (for example, any OSS "courses in Git" projects).
- Recommendation-engine OSS beyond pgvector was not researched.