# TLC Lifelong Learning On-Demand | TILOS / LCAPE — V7 Master Specification

## Scope
Offline interactive demonstration with 680 downloadable Word drafts, course manuals, personal dashboards, case/client records, quiz scoring and per-demo-user learning logs, instructor applications, membership demonstration, media library and payment order simulation. NOT a live legal or financial service.

## Identity & roles
Member ID / Lawyer ID / Instructor ID linked to RBAC and licensed attorney verification via explicitly approved interfaces. Production OAuth/OIDC: ThaID, Google, Facebook, LINE. Passkey via WebAuthn, device-bound MFA, KYC, consent, session and audit trails. No credentials should be stored in browser localStorage.

## LMS
Courses, lessons, prerequisite graph, accessible video player, transcripts, bookmarks, submissions, marking rubric, discussion, assessment item bank, attempt log, certificates with independently verifiable ID, CPD only if formally accredited.

## Media CMS
Media assets with media_id, title, type, URL, description, tags, owner, rights, source, language, transcripts, lifecycle state, version and review date. URL importing requires validation, copyright authorization, safe preview, link-health checks and approval workflow. Full text from transcripts and documents with rights-aware access.

## Legal operations
Case/client management: explicit lawful basis; segregation of training mock-data from real legal service databases; attorney-client confidentiality, detailed evidence chain-of-custody, secure audit logs, retention schedule and legal holds; station check-in/out and officer countersignature, anti-duplicate claims, maker/checker approvals.

## Payments
PCI-compliant payment service provider to tokenize card credentials, PromptPay dynamic QR, banking and supported wallets as contracted. Server-side webhook with signature/replay/idempotency verification, immutable ledger, invoices, receipts, refunds, reconciliation, subscription entitlements and teacher revenue share payouts. Store no CVV, raw card or OTP. Payment collection and volunteer reimbursements must be separate ledger flows.

## Instructor marketplace
Identity and qualifications verification, subject review, lesson proposal, content ownership/IP agreement, quality approval, revenue share contracts and tax treatment, settlement and dispute workflow. Proposed splits are not preset TLC policy.

## Security
Data protection impact assessment, threat model, data classification, PII redaction, private AI boundary, encryption with managed keys, least privilege, data access logging, secure upload scanning, incident response, disaster recovery, penetration testing and routine access review. Integrations require authorization and contracts.

## Data entities
users, member_profiles, identity_links, roles, subscriptions, entitlements, courses, modules, lessons, media_assets, quiz_questions, quiz_attempts, progress_events, certificates, instructors, creator_agreements, clients, cases, evidence, shifts, station_attestations, volunteer_claims, payment_orders, transactions, payouts, notifications, meetings, audit_events.

## API domains
/auth /members /courses /media /learning-events /quizzes /certificates /instructors /cases /clients /station-shifts /claims /orders /transactions /payouts /alerts /meetings /audit. All sensitive endpoints enforce access control and record audit events.

## Deployment roadmap
1. Offline validation: UI, search, 680 Word files, quiz, media indexing, learning demo data.
2. Online secure MVP: backend, databases, identity, payments, LMS/media delivery, real audit.
3. Institution rollout: approved ThaID and registry integrations, station workflows, official certificate/CPD, AI RAG, monitoring and governance.

## Required release criteria
No unverified legal document presented as official; Thai text legible on desktop/mobile; privacy/security review; quiz correctness; payment webhook security; offline-to-online data migration strategy; creator rights and revenue terms agreed; external integrations tested and authorized.