Quiiz system

README.md

@@ -71,6 +71,7 @@ devplacepy/
 | `/media` | Per-attachment soft delete and restore: `POST /media/{uid}/delete` (owner or admin), `POST /media/{uid}/restore` (admin) |
 | `/uploads` | Attachment management (full lifecycle for the signed-in user, same files that appear on posts and other content): `POST /uploads/upload` (multipart) and `POST /uploads/upload-url` (from URL) create; `GET /uploads` lists your own attachments (paginated, newest first, optional `linked` filter); `GET /uploads/{uid}` returns one; `PATCH /uploads/{uid}` renames its display filename (the file extension is always preserved); `DELETE /uploads/delete/{uid}` removes one. Reading and modifying another user's attachment is owner-or-admin; files are served at `/static/uploads/` |
 | `/admin/trash` | Admin **Trash**: review, restore, and permanently purge soft-deleted content (posts, comments, gists, projects, news, project files, attachments) across the platform |
+| `/admin/devii-tasks` | Admin **Devii tasks**: every scheduled task across all owners with its schedule, run count, expiry and failure streak, plus per-task disable and delete |
 | `/notifications` | Notification list, mark read, live unread counts (`/notifications/counts`) |
 | `/messages` | Real-time direct messaging over WebSocket (`/messages/ws`): live bidirectional delivery, optimistic send, typing indicators, read receipts, and online/last-seen presence. Messages render through the shared content pipeline (emoji shortcodes, image, video and audio embeds, autolink, sanitization). AI content correction and the AI modifier apply to direct messages, so typing an inline `@ai <instruction>` in a message executes it and the resolved result appears live in the chat for both participants (the `message` WS frame carries an additive `ai_processed` flag when a pending correction/modification was applied). An opened conversation loads its 500 most recent messages; older history is retained in the database. `GET /messages/conversations` returns the conversation list as JSON for a live client refresh; the `POST /messages/send` form remains as a no-JavaScript fallback and now accepts an attachment-only, empty-content message. `POST /messages/ws-ticket` exchanges a session/API-key auth to a short-lived (30s), single-use ticket a browser WebSocket can carry as `?ticket=...` on the handshake, since a native `WebSocket` cannot set an `Authorization`/`X-API-KEY` header - this is what makes off-session embedding of the chat possible. CLI: `devplace messaging prune-tickets` removes expired tickets |
 | `/votes` | Upvote/downvote on posts, comments, projects |
@@ -82,6 +83,7 @@ devplacepy/
 | `/mute` | Mute/unmute a user: stops them creating notifications for you while their content stays visible |
 | `/leaderboard` | Contributor ranking by total stars earned |
 | `/game` | **Code Farm** cooperative idle game (member-only): plant projects that build over real time, harvest coins and XP, upgrade CI, buy plots, and water friends' builds at `/game/farm/{username}`. Live over pub/sub; every endpoint negotiates JSON |
+| `/quizzes` | **Quizzes**: author quizzes, play them, and climb the cross-quiz scoreboard. Three-column hub with filters (`all`/`todo`/`done`/`mine`/`drafts`), search, per-viewer state badges, and the scoreboard rail; `/quizzes/{slug}` detail, `/quizzes/{slug}/edit` builder, `/quizzes/{slug}/attempts/{uid}` player, `/quizzes/scoreboard` JSON. Publishing is permanent. Every endpoint negotiates JSON |
 | `/avatar` | Multiavatar proxy with in-memory cache |
 | `/issues` | Issue tracker backed by Gitea: list/detail/comment/status, AI-enhanced filing, an admin planning report over a selectable set of open tickets (each ticket's full text reproduced verbatim so the document hands straight to a coding agent), and file attachments on open issues and comments (mirrored to the Gitea tracker) |
 | `/admin/services` | Background service management (start/stop, config, status, logs) |
@@ -113,6 +115,47 @@ Member progression is driven by activity and peer recognition.
 
 Every AI gateway response (`/openai/v1/*`) also returns per-call `X-Gateway-*` headers with the full token breakdown and the dollar cost of that call, so any client can read its own usage.
 
+## Quizzes
+
+**Quizzes** (`/quizzes`) let any signed-in member write a quiz and every member play it. The hub is
+one page with three columns: filters and search on the left, the quiz list in the middle showing
+what you still have to do and what you already completed with your score, and the cross-quiz
+scoreboard on the right. Guests read published quizzes and see the board; they cannot play.
+
+- **Eight question kinds.** Single choice, multiple choice, true/false, free text, fill in the
+  blanks, numeric, ordering, and matching. Seven are graded deterministically, several with partial
+  credit. Ordering and matching use plain selectors and keyboard controls, never a drag-only
+  interaction, so they work with a keyboard and a screen reader.
+- **AI-graded free text.** A free-text answer is reviewed by the platform's own AI against the
+  author's reference answer and grading criteria, billed to the answering member's own API key. The
+  score is re-clamped on the server and the correct/incorrect verdict is derived from the clamped
+  score, so a reviewer can never mark an answer correct while scoring it zero. When the reviewer is
+  unavailable the answer is still graded, by a deterministic keyword comparison, and is visibly
+  stamped as such - grading never silently becomes a zero.
+- **Publishing is permanent.** A draft is fully editable; publishing freezes the quiz, its
+  questions and its options forever. There is no unpublish and no post-publish edit, which is what
+  makes two members' scores on the same quiz comparable. The builder shows a live pre-publish
+  checklist and keeps the Publish button disabled until it is empty, and the action is confirmation
+  gated on both the web UI and in Devii.
+- **One attempt at a time.** Starting a quiz creates an attempt that lives on the server, so a
+  refresh, a second tab and a different device all resume the same one. Each question can be
+  answered exactly once. A time limit is a deadline stored on the attempt, evaluated when someone
+  looks at it - nothing runs in the background.
+- **Settings.** Shuffle the questions, shuffle the options, reveal the correct answer after each
+  question, allow reviewing every answer on the results screen, set a time limit, set a pass mark.
+- **An honest scoreboard.** Your **best** attempt per quiz counts, never the sum of your attempts,
+  so replaying a quiz can raise your contribution up to your personal best and never beyond it.
+  Quizzes you wrote yourself count like any other. Each quiz also has its own leaderboard.
+- **Full automation.** Devii creates a complete quiz from one JSON document, publishes it, plays it
+  end to end and reads the result, all through the same public API - and the hub's *Create quiz
+  with Devii* button opens the assistant with that request already typed in (it never sends it for
+  you). The whole flow works without JavaScript too: every question is a real form.
+- **Engagement.** Quizzes carry comments, stars, bookmarks and reactions like any other content,
+  and appear in the sitemap.
+
+Retention: completed attempts are permanent; abandoned and expired ones are garbage-collected by
+`devplace quiz prune`.
+
 ## Code Farm
 
 The **Code Farm** (`/game`) is a cooperative idle game in the spirit of Farmville, themed for developers. Each member owns a farm of plots and plays asynchronously - nothing has to happen in real time.
@@ -143,7 +186,7 @@ The farm refreshes live over the pub/sub bus (a watered build appears on the own
 
 ## Engagement
 
-- **Emoji reactions** - a fixed palette of reactions on posts, comments, gists, and projects, separate from voting and carrying no ranking weight.
+- **Emoji reactions** - react with **any** emoji on posts, comments, gists, and projects, separate from voting and carrying no ranking weight. A short quick-pick palette covers the common reactions, and a `+` button next to it opens the full searchable emoji picker (every standard emoji, including skin tones), so a reaction is never limited to a preset list. Emoji already used on an item are shown as counted chips beside the palette.
 - **Emoji shortcodes** - typing a `:name:` shortcode in any content (posts, comments, titles, project and gist descriptions, news, and direct messages) renders the matching emoji, using the full GitHub/Discord standard set (for example `:rocket:` becomes a rocket). Server-rendered and live content share one shortcode list; unknown names and shortcodes inside code are left untouched. Documented at `/docs/emoji-shortcodes`. This is distinct from the visual emoji-picker button in the composer, which inserts the literal emoji character.
 - **Polls** - a post can carry a poll (question plus up to six options); results appear as live bars once the viewer votes, one vote per member. A poll can be attached when the post is created or added later by editing a post that has none.
 - **Bookmarks** - save posts, gists, projects, and news to a personal list at `/bookmarks/saved`.
@@ -589,7 +632,19 @@ are run by the background service, so a queued reminder survives a server restar
 even if you have closed the Devii terminal. When a reminder fires you receive an in-app
 notification and a live toast carrying its message (the **Reminders** notification type, which
 you can toggle like any other on your profile), in addition to the result appearing in the
-terminal. Manage your reminders conversationally (list, change, run now, or delete them).
+terminal.
+
+**Scheduling is restricted to administrators**, and every scheduled task is bounded. Members can
+list and delete tasks they already own but cannot create, change, or trigger one. A repeating
+task must leave at least fifteen minutes between runs, carries a maximum number of executions,
+and expires at most thirty days after its first run, so nothing runs forever. A task that fails
+several times in a row, whose owner has been inactive for a month, whose owner stops being an
+administrator, or that passes its automation spend limit is disabled automatically with the
+reason recorded in the audit log. Across the whole platform only a few scheduled tasks run at
+the same time, handed out one at a time per owner, so a single account can never monopolise the
+scheduler. Administrators see every task, its owner, and its bounds at **Admin -> Devii tasks**,
+where any task can be disabled or deleted, and the same is available from the command line with
+`devplace devii tasks`.
 
 Configuration on the Services tab:
 
@@ -613,6 +668,11 @@ Configuration on the Services tab:
 | `devii_rsearch_timeout` | `300` | Read timeout (seconds) for `rsearch_*` calls; web-grounded answers can take minutes; minimum five minutes |
 | `devii_email_enabled` | on | Enable the email tools (`email_*`) for signed-in users |
 | `devii_email_timeout` | `30` | Connection/read timeout (seconds) for IMAP and SMTP calls |
+| `devii_task_max_concurrent` | `4` | Scheduled tasks running at once across all owners, handed out round-robin, one at a time per owner |
+| `devii_task_max_per_owner` | `10` | Active scheduled tasks one administrator may hold (`0` = no cap) |
+| `devii_task_daily_usd` | `0.5` | Rolling 24h spend cap for scheduled runs, separate from the interactive quota (`0` = unlimited) |
+| `devii_task_max_failures` | `3` | Consecutive failures after which a task disables itself (`0` = never) |
+| `devii_task_owner_idle_days` | `30` | Disable an owner's tasks after this many days without activity (`0` = never) |
 
 Beyond the platform tools, Devii has external **web** tools. `fetch_url` reads a web page;
 `http_request` makes an arbitrary HTTP call (GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS) to any