Aelira Core v0.9.7: broader STEM support, stricter verification

Aelira Core v0.9.7 is available

Aelira Core v0.9.7 is now available. It is a broad release, but the thread running through it is simple: accessibility automation needs wider coverage and stricter limits at the same time.

This release adds support for more of the material found in real university courses, especially difficult STEM content. It also strengthens the evidence, isolation, and operational controls around that work.

The boundary matters. v0.9.7 does not claim that recognizing an equation or chemical structure proves the result is correct. Unsupported or ambiguous material stays open for human review, and recognition alone never approves an artifact.

More kinds of STEM content can enter a bounded workflow

The largest addition is a general STEM remediation pipeline for PDFs. It now covers:

• printed and scanned equations;

• screenshots containing several equations in a defined order;

• equations drawn as vector objects inside a PDF;

• bounded handwritten mathematics;

• chemical formulas and reactions;

• molecular structure diagrams;

• commutative diagrams; and

• mixed visuals containing several supported region types.

Each type has its own contract and deliberate limits. Chemical formulas, for example, are parsed into deterministic notation, speech, and passive MathML. The parser does not guess compound names or balance reactions. Molecular drawings must resolve to a complete supported graph. Commutative diagrams can be represented as objects, arrows, and paths, but the software does not claim to prove that a diagram commutes.

Handwritten mathematics has an especially narrow admission policy. Low-contrast writing, strike-throughs, annotations, multiple lines, non-mathematical handwriting, and unsupported dense notation do not get pushed through as successful recognition. They remain human work.

Why we added it: generic OCR can recover characters while losing the relationships that carry meaning in mathematics and science. A confident transcription attached to the wrong source is worse than an issue that remains visibly unresolved. The new specialists let Aelira handle more real course material without hiding uncertainty.

Verification follows the exact source through to the saved PDF

For supported STEM visuals, a detector first records the exact source occurrence, page, geometry, and digests. A purpose-bound specialist may then propose a typed semantic result. A separate, context-isolated verification pass checks it without receiving the first reading.

That agreement is a rejection gate, not proof of mathematical or scientific truth. The proposed result still has to be associated with the original source, written into a candidate PDF, reopened, and checked again. Human approval is bound to the evidence and digests for that exact candidate, and becomes invalid if the candidate changes.

Mixed visuals add another layer. Every region must resolve to the right specialist, in a complete reading order, before Aelira composes one result. A missing, stale, duplicate, or mismatched route rejects the whole composition.

Why we added it: accessibility is not achieved by generating a plausible description somewhere in a pipeline. The semantics have to belong to the correct visual, survive the saved-file process, and remain the same artifact a person reviewed.

Compliance reporting now describes current evidence more honestly

v0.9.7 adds accessibility evidence reports, current-state projections, canonical regulatory profiles and deadlines, institution rollups with declared coverage, colour-vision-deficiency metrics, and durable weekly summaries.

Current compliance now uses the latest verified state for each document. Historical scans remain part of the record, but an old attempt cannot quietly reappear as the current result. Remediation candidates do not improve current compliance simply because a job started or produced a draft.

The CLI can also retrieve verified PDF report artifacts. Evidence reports state what Aelira checked and where its limits are; they are not accessibility or legal determinations.

Why we added it: institutions need evidence they can inspect and scope, not a score that looks more certain than the underlying work. Deadlines also need to come from the institution's actual regulatory profile rather than a generic default.

AI provider choice is explicit

Open-core no longer makes an implicit AI-vendor choice. Text generation, fallback generation, and semantic embeddings are independently opt-in. Administrators can select a workspace provider, store credentials encrypted, and bind execution to the authenticated workspace and purpose.

The WCAG knowledge corpus can bootstrap through provider-neutral routing, and the release includes evaluated guidance for supported local-model configurations. Deterministic scanning still works without a model.

Why we added it: self-hosting should give an institution control over where its content goes. A local model, a chosen cloud provider, and no AI provider at all are materially different decisions. The software should not make one silently.

Heavy work is isolated from the API

CPU- and browser-intensive scans and remediations now run only in the standalone worker service. API processes enqueue bounded jobs and remain independently responsive. The default Compose configuration includes a single-job worker, resource limits, durable leases, killable child-process execution, and worker-specific health reporting.

The API and worker now have separate liveness and readiness probes. Privacy-bounded metrics and sustained Prometheus alerts cover unavailable APIs, missing heartbeats, expired leases, and stalled jobs, including recovery notifications.

Several endpoints are asynchronous as a result. Multimedia transcription returns a scan handle, and Brightspace remediation returns job descriptors with authenticated status URLs.

Why we added it: document remediation can be slow, CPU-heavy, and occasionally hostile to the process running it. That work should be bounded and observable without taking the API down with it.

LMS, administration, and CLI paths are more complete

Brightspace gains course discovery and durable asynchronous remediation. Blackboard LTI gains verifiable RSA signing keys and a JWKS endpoint. Microsoft OAuth tests now exercise the real HTTP seam. The CLI can retrieve report artifacts and verify that the downloaded bytes match the server's claim.

Provisioning is admin-gated by default, with safer first-administrator bootstrap and department administrator handoff. Bootstrap, magic-link consumption, and open-signup provisioning are serialized so concurrent requests cannot create conflicting authority.

Why we added it: accessibility work has to meet staff inside the LMS and administrative workflows they already use. Those entry points also carry real authority, so discovery, handoff, signing, and report retrieval need verifiable boundaries.

Security and smaller interface fixes

Analytics, evidence reports, projections, artifacts, provider configuration, and institution rollups are now explicitly tenant-scoped. CSRF and session-cookie scopes are separate, routine authentication logs exclude sensitive identifiers, and audit attribution trusts only configured proxy networks.

PDF image traversal now rolls back safely when a nested operation fails. API key tables remain usable on narrow screens, and AI-provider controls stay inside their cards on phones. Dashboard images upgrade the fixed Alpine OpenSSL runtime packages before application artifacts are copied.

Release security checks now inspect the Python packages installed in the final container image instead of attributing stale packages from an unused lower layer. The workflows also use reviewed, commit-pinned Node 24-compatible actions, and the release verifies that documented environment settings match the runtime configuration.

Why we added it: the less visible parts of a self-hosted platform are where trust is usually won or lost. Scope, rollback, audit evidence, final-image security, and ordinary settings screens all need to be dependable.

What operators need to know

This release includes database, worker, provider, Blackboard, and client-contract changes. Operators should pause intake, back up PostgreSQL and verify the restore path, run the migration explicitly, configure the new provider and signing settings where applicable, and deploy the API and worker from the same v0.9.7 release.

The multimedia and Brightspace response contracts are now asynchronous. The unauthenticated HTTP focus-order analysis endpoints have been removed; the independent CLI focus command and worker/scanner capability remain available.

Read the full upgrade procedure and exact compatibility notes in the v0.9.7 release before updating a deployment.

The direction of the project

The open-source edition remains free to self-host. v0.9.7 moves it closer to the work universities actually have: difficult documents, mixed STEM material, several LMSs, institution-wide evidence, explicit model choices, and long-running jobs that need to survive failure.

It also keeps the most important limit visible. Aelira can detect, structure, verify, and document more than it could in v0.9.6. It cannot establish an author's intended meaning, mathematical correctness, chemical plausibility, or pedagogical quality. A person still reviews the exact candidate before it becomes an approved artifact.

That is the point of this release: broader assistance, with a clearer refusal line.

The source, installation instructions, and full changelog are available on GitHub.