MaestroMaestro Overview — contents
The Concept
Academic Integrity
Integrity is carried by the design of the platform, not by watching the learner. This topic covers how the system stays honest against cheating, against gaming the adaptivity or the Companion, and against its own misreadings — with no proctoring.
Maestro is architected around integrity by design, not surveillance: no cameras, no lockdown, no proctoring. Four design mechanisms carry integrity; the Companion is structurally bounded against being steered toward answers; and a Behavioural Signal Layer catches patterns of gaming as supportive evidence — never as a verdict. Grades attach to triangulated mastery belief, never to a raw Evidence Check outcome.
Integrity by design, not surveillance
Traditional integrity relies on watching the learner during assessment: proctoring cameras, browser lockdown, identity checks at exam time, timed windows, prohibited AI use. Maestro deliberately does not work this way. The architecture is fully self-paced with no proctoring, and integrity is carried through the design itself. This isn't a gap to be plugged later — it is the integrity strategy, and it shows through the whole platform.
The team is open to investigating whether additional layers at the summative level could add value — but expects them to be consistent with the philosophy (stronger process-evidence capture, deeper AI-use auditing, richer decision-log requirements), not surveillance grafted onto a model built to make surveillance unnecessary. This is a discovery-phase question, informed by how the January cohort actually performs.
The four integrity mechanisms
Four mechanisms carry integrity, each already built into the design:
| Mechanism | How it protects integrity |
|---|---|
| Personalised context, common rigor | Every learner produces the same artifact type against the same rubric, but the context, audience, and use case are personal. Copying becomes meaningless — a shared answer no longer fits either learner's context — while the standard stays identical. |
| Redesigned-for-contribution assessments | Summative work produces artifacts grounded in the learner's own professional situation (decision briefs, toolkits, frameworks). These are hard to fake because they require genuine engagement with a specific context the learner is describing. |
| Active AI-use expectation | Maestro doesn't ban AI — it expects, requires, and structures disclosed AI use. Each Evidence Check captures reasoning and confidence alongside the response, so the learner's own thinking is visible at every step. The question is "did you exercise your own judgment and disclose it," not "did you use AI." |
| Misconception blockers on submission | Confirmed misconceptions on KCs a milestone depends on block submission until cleared — catching work that superficially passes but rests on a wrong model that proctoring could never detect. |
Resisting Companion steering
Could a learner steer the AI Companion into giving them answers? This attack is architecturally constrained in a way tutor-bot jailbreaks are not, because the Companion is not an open assistant with answers to extract. It is bounded by four structural constraints simultaneously:
| Constraint | What it enforces |
|---|---|
| Anchor scope | Every interaction sits inside an authored Learning Anchor with a defined purpose. The Companion can only operate within the anchor's purpose — it has no free-form mode. |
| Forbidden moves | Each anchor declares explicit forbidden moves: never replace the Evidence Check, reveal answers before submission, invent content outside the approved spec, diagnose outside governed bindings, override routing, or behave as an unbounded chatbot. Enforced at the prompt level and validated by the fidelity check. |
| Content-spec grounding | The Companion operates against the approved Level 2 content spec for the current node. It has no access to Evidence Check answers, rubric grading criteria, or milestone submissions — they aren't in its context. |
| Runtime handoff bounds | When it composes runtime-dynamic content, it composes against the evidence record, the learner-model state, and the anchor's message template — not a free prompt window. |
A fifth layer sits alongside: steering-attempt logging. Occasional curiosity is legitimate; a learner who systematically probes for boundary weaknesses or injects role-change attempts produces a pattern that is logged and surfaces for SME review when it rises above baseline. The structural constraints catch the individual attempts; the behavioural layer catches the pattern.
Resisting mastery gaming
The deeper protection is against a sophisticated learner producing plausible-sounding responses without genuine understanding. Five interlocking mechanisms — already described in the evidence model — do the work: reasoning capture at every Evidence Check, confidence calibration, SOLO depth judgment, misconception traps embedded in the check design, and the confirming-probe subroutine. Together they make it hard to fake mastery, because a fluent wrong answer still reveals itself in the reasoning, the confidence-correctness mismatch, or the recurring trap.
The Behavioural Signal Layer
Alongside the five mechanisms sits a Behavioural Signal Layer that reads signals already present in the interaction and feeds them into the diagnostic layer as supportive evidence, never as verdict:
time-to-first-keystroke · response and reasoning composition durations · paste detection · typing rhythm on the reasoning field · confidence-response latency · tab-focus events · AI-generated-text fingerprinting · stylistic consistency across submissions · Companion steering-attempt events.
Signals are meaningful relative to the specific learner's own baseline, not universal thresholds. A single paste or one short reasoning composition means little; a sustained pattern combined with weak reasoning depth and misconception-trap avoidance forms a materially stronger signal than any single mechanism alone.
No cameras, no microphone monitoring, no screen recording, no browser lockdown, no keystroke-content logging beyond what the learner submits. Behavioural signals are invisible to the learner as diagnostic outputs — they see their mastery diagnosis (secure, fragile, misconception, gap, slip), not the signals behind it. Signals are visible to the SME during grading and integrity review, informing judgment without automating findings, and they stay inside Maestro under the same privacy boundary as the rest of the learner model — nothing goes to the LMS as raw signals.
Behavioural signals feed diagnosis in release one and populate the learner's behavioural baseline from the start, so the baseline is meaningful when later capabilities depend on it. Client-side capture on Evidence Check and Companion UIs (timing, paste, tab focus, typing-rhythm summary); server-side enrichment (AI-fingerprint scoring, baseline computation, deviation flags). See Learning Signals for the full inventory and the same-shape principle.
The complete seven-layer Defense Stack — incentive design, task design, per-learner variation, template classification, behavioural signals, longitudinal triangulation, and dialogic verification, with the authoring/runtime split and who builds each — is specified in Interactives & the Evidence System, together with the template tiers and the design laws.
Identity via LTI
Identity verification is not a separate concern in this model. LTI 1.3 launches deliver verified identity from Moodle at course entry, tied to the university's SIS and student registration. Identity is established at launch and persists through the session — there is no assessment moment where the learner's identity is uncertain. (See Integration.)