fix: Randomise quiz option order per attempt; apply review feedback - #8
Merged
Conversation
Use Xerte Nottingham's per-question `answerOrder="random"` attribute so answer options shuffle on every attempt (the engine's HTML5 quiz model honours it and computes scoring from the shuffled array, so SCORM tracking is unaffected). Applied to all 45 questions across the 8 quizzes; the question-level `order="random"` already shuffled question order, so both layers now randomise per attempt. This removes the previous bias where the correct answer was frequently the first option, most visible in the final comprehensive quiz. Feedback fixes applied to source/data.xml + source/preview.xml (kept byte-identical) and reflected in the docs: - Theme 1 Quiz Q2: "mitigations for authentication failures" → "mitigations against authentication attacks" (clearer; the controls defend against attacks, not "for" failures). - Injection (A05:2025) page: the "Use safe ORM APIs" bullet is replaced with parameterised-query guidance — an ORM is not inherently injection-proof; use its parameterised methods and never concatenate raw input into queries. - Theme 7 Quiz Q2 (logging tool calls): the correct answer was inverted (False was marked correct, implying logging tool calls is not recommended). Swapped so True is correct, matching the Theme 7 content page and the final-quiz question that treats missing agent logs as a Security Logging and Alerting Failure. We must be able to prove what an agent did and why; privacy is handled by privacy-aware logging, not by not logging. - Final quiz, over-scoped CRM tool question: reframed from "which risk is this?" (Tool Misuse) to "which principle best prevents the risk?" with "Scope each tool to least privilege" as the correct answer — the lesson the scenario actually teaches. - New "Course complete" page (page 44) after the final quiz so it is unambiguous the training is over (result recorded by the LMS, 80% pass mark / last-attempt rule, "you may close this window"). Top-level page count is now 44. Provenance: removed the generation details (pi harness version and LLM model names) from the About and References pages since they have been upgraded since; replaced with a generic "Generated with the assistance of an AI coding agent. Not endorsed by OWASP." note. Docs updated to match: - docs/PROJECT_CONTEXT.md: page count (44), new answerOrder="random" state + convention #10, updated SCORM completion off-by-one analysis (the untracked last node is now the harmless Course complete page; the Final quiz's completion is now tracked), verification checklist lines, provenance quote. - docs/COURSE_SPEC.md: Theme 1 Q wording, Injection mitigations wording, answerOrder note, Page 44 Course complete, totals (44), provenance. - docs/COURSE_VERIFICATION.md: new "Feedback pass" section documenting all six changes + local checks; provenance mention updated. Validated end-to-end through the running XOT instance (convention 9): pushed the updated source into the container, opened the HTML5 editor (page tree shows 44 pages, in-memory lo_data loaded answerOrder="random" on all 45 questions), Published (round-trip preserved answerOrder on all 45, the Course complete page, the new provenance, and all tracking attrs), synced the XOT-published data.xml/preview.xml back to source/ (canonical XML identical to the hand-edited version), re-exported SCORM, and grepped the exported template.xml against the checklist — all values pass (45 questions, 45 answerOrder="random", trackingMode="full", trackingPassed ="80%", trackingWeight 1×7 + 21, judge="true" ×8, unmarkForCompletion ×1, xPersistProgress ×1, delaySecs="0" ×27, 0 empty options, Course complete page present, 0 old provenance refs). End-to-end UI walk in play.php confirmed options and question order reshuffle between attempts and scoring remains correct, and the Course complete page renders. No SCORM zip is committed (built by the release workflow; in .gitignore). Generated with pi 0.81.1 and GLM 5.2
📖 Course content previewDownload the
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Use Xerte Nottingham's per-question
answerOrder="random"attribute so answer options shuffle on every attempt (the engine's HTML5 quiz model honours it and computes scoring from the shuffled array, so SCORM tracking is unaffected). Applied to all 45 questions across the 8 quizzes; the question-levelorder="random"already shuffled question order, so both layers now randomise per attempt. This removes the previous bias where the correct answer was frequently the first option, most visible in the final comprehensive quiz.Feedback fixes applied to source/data.xml + source/preview.xml (kept byte-identical) and reflected in the docs:
Provenance: removed the generation details (pi harness version and LLM model names) from the About and References pages since they have been upgraded since; replaced with a generic "Generated with the assistance of an AI coding agent. Not endorsed by OWASP." note.
Docs updated to match:
Validated end-to-end through the running XOT instance (convention 9): pushed the updated source into the container, opened the HTML5 editor (page tree shows 44 pages, in-memory lo_data loaded answerOrder="random" on all 45 questions), Published (round-trip preserved answerOrder on all 45, the Course complete page, the new provenance, and all tracking attrs), synced the XOT-published data.xml/preview.xml back to source/ (canonical XML identical to the hand-edited version), re-exported SCORM, and grepped the exported template.xml against the checklist — all values pass (45 questions, 45 answerOrder="random", trackingMode="full", trackingPassed ="80%", trackingWeight 1×7 + 21, judge="true" ×8, unmarkForCompletion ×1, xPersistProgress ×1, delaySecs="0" ×27, 0 empty options, Course complete page present, 0 old provenance refs). End-to-end UI walk in play.php confirmed options and question order reshuffle between attempts and scoring remains correct, and the Course complete page renders.
No SCORM zip is committed (built by the release workflow; in .gitignore).
Generated with pi 0.81.1 and GLM 5.2