# INSTINCT EDUCATION — Architecture

## Layers
1. Laravel routing + middleware
2. Controllers
3. Eloquent models
4. MySQL relational database
5. Blade presentation
6. Prebuilt front-end assets
7. Optional Tailwind/Vite rebuild

## Roles
- Admin: all management modules
- Teacher: own question bank, own exam sessions, results/review
- Participant: profile, catalog, exam attempts, history, certificates

## Core entities
- User
- ExamCategory
- Question
- QuestionOption
- Exam
- ExamAttempt
- AttemptAnswer
- Certificate

## Exam workflow
Published Exam
-> Participant starts attempt
-> Server generates fixed question/option order
-> Server sets started_at + expires_at
-> Blade CBT UI renders timer/navigation
-> Browser temporarily mirrors answers to localStorage
-> Final submit is scored on server
-> MCQ is scored automatically
-> Essay causes needs_review=true
-> Staff reviews essay
-> Score is recalculated
-> Certificate is issued when score >= passing grade and no pending review

## Security decisions
- Laravel CSRF middleware
- Laravel session authentication
- Role middleware
- Eloquent / query builder parameter binding
- Image MIME validation
- Uploads limited to JPG/PNG/WEBP
- Executable uploads denied by `.htaccess`
- Laravel root stays outside public document root
- Question order and answer scoring are authoritative on the server