Implementation Guide: Provide personalized adaptive practice, adjusting difficulty in real time

sudo apt-get update && sudo apt-get install -y unifi

speedtest-cli --simple

curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
az login

az group create --name rg-adaptive-learning --location eastus

az appservice plan create \
  --name asp-adaptive-learning \
  --resource-group rg-adaptive-learning \
  --sku B2 \
  --is-linux

az webapp create \
  --name adaptive-practice-api \
  --resource-group rg-adaptive-learning \
  --plan asp-adaptive-learning \
  --runtime 'PYTHON:3.11'

az postgres flexible-server create \
  --name adaptive-learning-db \
  --resource-group rg-adaptive-learning \
  --location eastus \
  --sku-name Standard_B2s \
  --tier Burstable \
  --storage-size 32 \
  --version 16 \
  --admin-user adaptiveadmin \
  --admin-password '<GENERATE_STRONG_PASSWORD>' \
  --public-access 0.0.0.0

az postgres flexible-server parameter set \
  --resource-group rg-adaptive-learning \
  --server-name adaptive-learning-db \
  --name azure.extensions \
  --value pgvector

az storage account create \
  --name adaptivelearningstorage \
  --resource-group rg-adaptive-learning \
  --location eastus \
  --sku Standard_LRS \
  --kind StorageV2

az storage container create --name curriculum-content --account-name adaptivelearningstorage
az storage container create --name interaction-logs --account-name adaptivelearningstorage
az storage container create --name analytics-exports --account-name adaptivelearningstorage

az webapp config appsettings set \
  --name adaptive-practice-api \
  --resource-group rg-adaptive-learning \
  --settings \
  GOOGLE_API_KEY='<GEMINI_API_KEY>' \
  OPENAI_API_KEY='<OPENAI_API_KEY>' \
  PINECONE_API_KEY='<PINECONE_API_KEY>' \
  DATABASE_URL='postgresql://adaptiveadmin:<PASSWORD>@adaptive-learning-db.postgres.database.azure.com:5432/adaptive_learning' \
  AZURE_STORAGE_CONNECTION_STRING='<CONNECTION_STRING>' \
  CLEVER_CLIENT_ID='<CLEVER_CLIENT_ID>' \
  CLEVER_CLIENT_SECRET='<CLEVER_CLIENT_SECRET>' \
  LANGSMITH_API_KEY='<LANGSMITH_KEY>' \
  LANGSMITH_PROJECT='adaptive-practice-prod' \
  ENVIRONMENT='production'

-- Connect to PostgreSQL
psql 'postgresql://adaptiveadmin:<PASSWORD>@adaptive-learning-db.postgres.database.azure.com:5432/adaptive_learning'

-- Create extensions
CREATE EXTENSION IF NOT EXISTS pgvector;
CREATE EXTENSION IF NOT EXISTS "uuid-ossp";

-- Core tables
CREATE TABLE students (
  id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
  clever_id VARCHAR(255) UNIQUE,
  google_id VARCHAR(255) UNIQUE,
  first_name VARCHAR(100) NOT NULL,
  last_name VARCHAR(100) NOT NULL,
  grade_level INTEGER,
  created_at TIMESTAMPTZ DEFAULT NOW(),
  updated_at TIMESTAMPTZ DEFAULT NOW()
);

CREATE TABLE skills (
  id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
  subject VARCHAR(50) NOT NULL,
  domain VARCHAR(100) NOT NULL,
  skill_name VARCHAR(255) NOT NULL,
  grade_level INTEGER,
  difficulty_level FLOAT DEFAULT 0.5,
  prerequisite_skill_ids UUID[],
  description TEXT,
  standard_code VARCHAR(50)  -- e.g., CCSS.MATH.CONTENT.4.NF.A.1
);

CREATE TABLE student_knowledge_state (
  id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
  student_id UUID REFERENCES students(id),
  skill_id UUID REFERENCES skills(id),
  p_know FLOAT DEFAULT 0.3,       -- P(L_0): probability student knows the skill
  p_transit FLOAT DEFAULT 0.09,   -- P(T): probability of learning on each opportunity
  p_slip FLOAT DEFAULT 0.1,       -- P(S): probability of slipping (wrong despite knowing)
  p_guess FLOAT DEFAULT 0.2,      -- P(G): probability of guessing (right despite not knowing)
  mastery_level FLOAT DEFAULT 0.0, -- Derived mastery (0.0 to 1.0)
  total_attempts INTEGER DEFAULT 0,
  correct_attempts INTEGER DEFAULT 0,
  last_practiced_at TIMESTAMPTZ,
  UNIQUE(student_id, skill_id)
);

CREATE TABLE curriculum_items (
  id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
  skill_id UUID REFERENCES skills(id),
  item_type VARCHAR(50) NOT NULL, -- 'question', 'hint', 'explanation', 'worked_example'
  difficulty FLOAT NOT NULL,       -- 0.0 (easy) to 1.0 (hard)
  content JSONB NOT NULL,          -- {stem, choices, correct_answer, solution_steps}
  embedding vector(768),           -- For semantic search via pgvector
  metadata JSONB,
  created_at TIMESTAMPTZ DEFAULT NOW()
);

CREATE TABLE sessions (
  id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
  student_id UUID REFERENCES students(id),
  started_at TIMESTAMPTZ DEFAULT NOW(),
  ended_at TIMESTAMPTZ,
  total_items_attempted INTEGER DEFAULT 0,
  total_correct INTEGER DEFAULT 0,
  skills_practiced UUID[],
  session_metadata JSONB
);

CREATE TABLE interactions (
  id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
  session_id UUID REFERENCES sessions(id),
  student_id UUID REFERENCES students(id),
  curriculum_item_id UUID REFERENCES curriculum_items(id),
  skill_id UUID REFERENCES skills(id),
  student_response TEXT,
  is_correct BOOLEAN,
  response_time_ms INTEGER,
  difficulty_at_time FLOAT,
  agent_feedback TEXT,
  agent_model_used VARCHAR(50),
  tokens_used INTEGER,
  created_at TIMESTAMPTZ DEFAULT NOW()
);

-- Indexes for performance
CREATE INDEX idx_knowledge_state_student ON student_knowledge_state(student_id);
CREATE INDEX idx_interactions_session ON interactions(session_id);
CREATE INDEX idx_interactions_student ON interactions(student_id);
CREATE INDEX idx_curriculum_items_skill ON curriculum_items(skill_id);
CREATE INDEX idx_curriculum_items_difficulty ON curriculum_items(difficulty);

pip install pinecone-client openai google-generativeai langchain-google-genai

# generates embeddings and upserts curriculum items to Pinecone

# Python script: embed_curriculum.py
import os
import json
import google.generativeai as genai
from pinecone import Pinecone, ServerlessSpec

# Initialize Pinecone
pc = Pinecone(api_key=os.environ['PINECONE_API_KEY'])

# Create index (768 dimensions for Google text-embedding-004)
pc.create_index(
    name='curriculum-items',
    dimension=768,
    metric='cosine',
    spec=ServerlessSpec(cloud='aws', region='us-east-1')
)

 index = pc.Index('curriculum-items')

# Initialize Google embedding model
genai.configure(api_key=os.environ['GOOGLE_API_KEY'])

def embed_text(text: str) -> list[float]:
    result = genai.embed_content(
        model='models/text-embedding-004',
        content=text
    )
    return result['embedding']

# Load curriculum items from JSON file
with open('curriculum_data.json', 'r') as f:
    items = json.load(f)

# Batch upsert to Pinecone
batch_size = 100
for i in range(0, len(items), batch_size):
    batch = items[i:i+batch_size]
    vectors = []
    for item in batch:
        text_to_embed = f"{item['skill_name']}: {item['content']['stem']}"
        embedding = embed_text(text_to_embed)
        vectors.append({
            'id': item['id'],
            'values': embedding,
            'metadata': {
                'skill_id': item['skill_id'],
                'subject': item['subject'],
                'grade_level': item['grade_level'],
                'difficulty': item['difficulty'],
                'item_type': item['item_type']
            }
        })
    index.upsert(vectors=vectors)
    print(f'Upserted batch {i//batch_size + 1}')

python embed_curriculum.py

pip install PyLTI1p3

openssl genrsa -out private.pem 2048 && openssl rsa -in private.pem -pubout -out public.pem

cd adaptive-practice-frontend
npm install
npm run build

az staticwebapp create \
  --name adaptive-practice-web \
  --resource-group rg-adaptive-learning \
  --source https://github.com/your-msp/adaptive-practice-frontend \
  --location 'eastus2' \
  --branch main \
  --app-location '/' \
  --output-location '.next' \
  --login-with-github

npx vercel --prod

az webapp cors add \
  --name adaptive-practice-api \
  --resource-group rg-adaptive-learning \
  --allowed-origins 'https://practice.yourdomain.com'

CREATE OR REPLACE FUNCTION cleanup_old_data() RETURNS void AS $$
BEGIN
  -- Archive interactions older than 3 years (adjust per district policy)
  INSERT INTO interactions_archive 
    SELECT * FROM interactions 
    WHERE created_at < NOW() - INTERVAL '3 years';
  DELETE FROM interactions 
    WHERE created_at < NOW() - INTERVAL '3 years';
  
  -- Delete session data older than 3 years
  DELETE FROM sessions 
    WHERE started_at < NOW() - INTERVAL '3 years';
  
  -- Log the cleanup
  INSERT INTO audit_log (action, details, performed_at)
    VALUES ('data_retention_cleanup', 
            json_build_object('deleted_before', NOW() - INTERVAL '3 years'),
            NOW());
END;
$$ LANGUAGE plpgsql;

-- Schedule via pg_cron (or Azure Automation Runbook)
SELECT cron.schedule('data-retention', '0 2 1 * *', 'SELECT cleanup_old_data()');

CREATE TABLE audit_log (
  id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
  action VARCHAR(100) NOT NULL,
  user_id UUID,
  user_role VARCHAR(50),
  details JSONB,
  ip_address INET,
  performed_at TIMESTAMPTZ DEFAULT NOW()
);

COPPA_UNDER_13 = True  # Enable enhanced protections
DATA_COLLECTION_MINIMAL = True  # Only collect educational data
AI_TRAINING_OPT_OUT = True  # Never send student data for model training

CREATE TABLE parental_consent (
  id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
  student_id UUID REFERENCES students(id),
  consent_type VARCHAR(100) NOT NULL,
  granted BOOLEAN NOT NULL,
  guardian_name VARCHAR(200),
  guardian_email VARCHAR(200),
  consent_date TIMESTAMPTZ,
  expiry_date TIMESTAMPTZ,
  ip_address INET,
  consent_document_url TEXT
);

GET /api/v1/dashboard/class/{class_id}/overview
GET /api/v1/dashboard/student/{student_id}/progress
GET /api/v1/dashboard/class/{class_id}/skill-mastery
GET /api/v1/dashboard/student/{student_id}/interactions
POST /api/v1/dashboard/class/{class_id}/settings

WS /ws/dashboard/{class_id}

az monitor metrics list \
  --resource adaptive-practice-api \
  --resource-group rg-adaptive-learning \
  --resource-type Microsoft.Web/sites \
  --metric 'Http5xx,HttpResponseTime,CpuPercentage,MemoryPercentage'

python -m pytest tests/test_agent_quality.py -v

az webapp update \
  --name adaptive-practice-api \
  --resource-group rg-adaptive-learning \
  --set siteConfig.numberOfWorkers=2

az appservice plan update \
  --name asp-adaptive-learning \
  --resource-group rg-adaptive-learning \
  --sku P1V3

az monitor autoscale create \
  --resource-group rg-adaptive-learning \
  --resource adaptive-practice-api \
  --resource-type Microsoft.Web/serverfarms \
  --name autoscale-adaptive \
  --min-count 1 --max-count 3 --count 1

az monitor autoscale rule create \
  --resource-group rg-adaptive-learning \
  --autoscale-name autoscale-adaptive \
  --scale out 1 \
  --condition 'CpuPercentage > 70 avg 5m'

az monitor autoscale rule create \
  --resource-group rg-adaptive-learning \
  --autoscale-name autoscale-adaptive \
  --scale in 1 \
  --condition 'CpuPercentage < 30 avg 5m'

az monitor metrics alert create \
  --name 'High Error Rate' \
  --resource-group rg-adaptive-learning \
  --scopes /subscriptions/<SUB_ID>/resourceGroups/rg-adaptive-learning/providers/Microsoft.Web/sites/adaptive-practice-api \
  --condition 'avg Http5xx > 5' \
  --window-size 5m \
  --action-group ops-team-alerts

python scripts/verify_all_students_login.py

# app/models/bkt.py
from dataclasses import dataclass

@dataclass
class BKTParams:
    """Bayesian Knowledge Tracing parameters for a single student-skill pair."""
    p_know: float = 0.3      # P(L_0): Prior probability of knowing the skill
    p_transit: float = 0.09  # P(T): Probability of learning on each opportunity
    p_slip: float = 0.10     # P(S): Probability of incorrect response despite knowing
    p_guess: float = 0.20    # P(G): Probability of correct response despite not knowing


class BayesianKnowledgeTracing:
    """Standard BKT implementation with extensions for adaptive difficulty."""
    
    def update(self, p_know: float, is_correct: bool,
               p_transit: float = 0.09, p_slip: float = 0.10,
               p_guess: float = 0.20) -> float:
        """
        Update the probability of knowledge given an observed response.
        
        Uses the standard BKT update equations:
        1. Posterior P(know | observation) via Bayes' rule
        2. P(know_new) = P(know | obs) + P(transit) * (1 - P(know | obs))
        
        Args:
            p_know: Current probability student knows the skill
            is_correct: Whether the student answered correctly
            p_transit: Probability of learning on this opportunity
            p_slip: Probability of slipping (wrong despite knowing)
            p_guess: Probability of guessing (right despite not knowing)
        
        Returns:
            Updated p_know (float between 0 and 1)
        """
        # Step 1: Compute posterior P(know | observation)
        if is_correct:
            # P(know | correct) = P(correct | know) * P(know) / P(correct)
            p_correct_given_know = 1.0 - p_slip
            p_correct_given_not_know = p_guess
            p_correct = (p_correct_given_know * p_know) + \
                        (p_correct_given_not_know * (1.0 - p_know))
            
            if p_correct == 0:
                posterior = p_know
            else:
                posterior = (p_correct_given_know * p_know) / p_correct
        else:
            # P(know | incorrect) = P(incorrect | know) * P(know) / P(incorrect)
            p_incorrect_given_know = p_slip
            p_incorrect_given_not_know = 1.0 - p_guess
            p_incorrect = (p_incorrect_given_know * p_know) + \
                          (p_incorrect_given_not_know * (1.0 - p_know))
            
            if p_incorrect == 0:
                posterior = p_know
            else:
                posterior = (p_incorrect_given_know * p_know) / p_incorrect
        
        # Step 2: Account for learning (transition)
        # P(know_new) = P(know | obs) + P(transit) * (1 - P(know | obs))
        p_know_new = posterior + (p_transit * (1.0 - posterior))
        
        # Clamp to valid probability range
        return max(0.001, min(0.999, p_know_new))
    
    def get_mastery_status(self, p_know: float) -> str:
        """Classify mastery level for display."""
        if p_know >= 0.95:
            return 'mastered'
        elif p_know >= 0.80:
            return 'proficient'
        elif p_know >= 0.50:
            return 'developing'
        elif p_know >= 0.30:
            return 'beginning'
        else:
            return 'not_started'
    
    def estimate_items_to_mastery(self, p_know: float, p_transit: float = 0.09,
                                    target: float = 0.95) -> int:
        """Estimate how many correct responses needed to reach mastery."""
        if p_know >= target:
            return 0
        
        items = 0
        current = p_know
        while current < target and items < 100:
            # Simulate a correct response
            current = self.update(current, is_correct=True, p_transit=p_transit)
            items += 1
        return items
    
    def optimal_difficulty(self, p_know: float) -> float:
        """
        Calculate the optimal item difficulty for maximum learning.
        Based on the Zone of Proximal Development principle:
        items should be challenging but achievable.
        
        Returns difficulty between 0.0 and 1.0.
        """
        # Target ~70% success rate (well-established in educational research)
        # Difficulty should be slightly above current ability
        optimal = p_know + 0.1  # Slightly harder than current knowledge
        optimal = max(0.1, min(0.9, optimal))  # Clamp to valid range
        return round(optimal, 2)

# app/integrations/clever.py
import os
import httpx
from fastapi import APIRouter, Request, HTTPException
from fastapi.responses import RedirectResponse
from sqlalchemy import select
from app.database import async_session, Student

router = APIRouter(prefix='/auth/clever')

CLEVER_CLIENT_ID = os.environ['CLEVER_CLIENT_ID']
CLEVER_CLIENT_SECRET = os.environ['CLEVER_CLIENT_SECRET']
CLEVER_REDIRECT_URI = os.environ.get(
    'CLEVER_REDIRECT_URI',
    'https://adaptive-practice-api.azurewebsites.net/auth/clever/callback'
)
CLEVER_AUTH_URL = 'https://clever.com/oauth/authorize'
CLEVER_TOKEN_URL = 'https://clever.com/oauth/tokens'
CLEVER_API_BASE = 'https://api.clever.com/v3.0'


@router.get('/login')
async def clever_login():
    """Redirect to Clever OAuth login page."""
    auth_url = (
        f'{CLEVER_AUTH_URL}?'
        f'response_type=code&'
        f'redirect_uri={CLEVER_REDIRECT_URI}&'
        f'client_id={CLEVER_CLIENT_ID}&'
        f'scope=read:user_id read:sis'
    )
    return RedirectResponse(url=auth_url)


@router.get('/callback')
async def clever_callback(request: Request, code: str):
    """Handle Clever OAuth callback, exchange code for token, fetch user info."""
    async with httpx.AsyncClient() as client:
        # Exchange authorization code for access token
        token_response = await client.post(
            CLEVER_TOKEN_URL,
            data={
                'code': code,
                'grant_type': 'authorization_code',
                'redirect_uri': CLEVER_REDIRECT_URI,
            },
            auth=(CLEVER_CLIENT_ID, CLEVER_CLIENT_SECRET)
        )
        
        if token_response.status_code != 200:
            raise HTTPException(status_code=401, detail='Failed to authenticate with Clever')
        
        token_data = token_response.json()
        access_token = token_data['access_token']
        
        # Fetch user identity
        me_response = await client.get(
            f'{CLEVER_API_BASE}/me',
            headers={'Authorization': f'Bearer {access_token}'}
        )
        me_data = me_response.json()['data']
        user_type = me_data['type']  # 'student', 'teacher', 'district_admin'
        user_id = me_data['id']
        
        # Fetch full user profile
        user_response = await client.get(
            f'{CLEVER_API_BASE}/{user_type}s/{user_id}',
            headers={'Authorization': f'Bearer {access_token}'}
        )
        user_data = user_response.json()['data']
        
        # Upsert user in local database
        async with async_session() as session:
            existing = await session.execute(
                select(Student).where(Student.clever_id == user_id)
            )
            student = existing.scalar_one_or_none()
            
            if not student:
                student = Student(
                    clever_id=user_id,
                    first_name=user_data.get('name', {}).get('first', ''),
                    last_name=user_data.get('name', {}).get('last', ''),
                    grade_level=int(user_data.get('grade', 0)) if user_data.get('grade') else None,
                )
                session.add(student)
            else:
                student.first_name = user_data.get('name', {}).get('first', student.first_name)
                student.last_name = user_data.get('name', {}).get('last', student.last_name)
                student.grade_level = int(user_data.get('grade', 0)) if user_data.get('grade') else student.grade_level
            
            await session.commit()
        
        # Create session token and redirect to frontend
        from app.auth import create_session_token
        session_token = create_session_token(
            user_id=str(student.id),
            user_type=user_type,
            clever_token=access_token
        )
        
        return RedirectResponse(
            url=f'https://practice.yourdomain.com/session?token={session_token}'
        )


async def sync_roster(access_token: str):
    """Full roster sync from Clever API. Run nightly via scheduled job."""
    async with httpx.AsyncClient() as client:
        headers = {'Authorization': f'Bearer {access_token}'}
        
        # Fetch all students
        students_response = await client.get(
            f'{CLEVER_API_BASE}/students',
            headers=headers,
            params={'limit': 1000}
        )
        students_data = students_response.json().get('data', [])
        
        async with async_session() as session:
            for s in students_data:
                s_data = s['data']
                existing = await session.execute(
                    select(Student).where(Student.clever_id == s_data['id'])
                )
                student = existing.scalar_one_or_none()
                
                if not student:
                    student = Student(
                        clever_id=s_data['id'],
                        first_name=s_data.get('name', {}).get('first', ''),
                        last_name=s_data.get('name', {}).get('last', ''),
                        grade_level=int(s_data.get('grade', 0)) if s_data.get('grade') else None,
                    )
                    session.add(student)
                else:
                    student.first_name = s_data.get('name', {}).get('first', student.first_name)
                    student.last_name = s_data.get('name', {}).get('last', student.last_name)
                
            await session.commit()
    
    return {'synced': len(students_data)}

# app/agents/safety_filter.py
import re
from dataclasses import dataclass
from enum import Enum

class FilterResult(Enum):
    SAFE = 'safe'
    BLOCKED_INJECTION = 'blocked_prompt_injection'
    BLOCKED_INAPPROPRIATE = 'blocked_inappropriate'
    BLOCKED_PII = 'blocked_pii'
    BLOCKED_OFF_TOPIC = 'blocked_off_topic'

@dataclass
class FilterResponse:
    result: FilterResult
    original_input: str
    sanitized_input: str | None
    reason: str | None


class StudentInputSafetyFilter:
    """Filter student inputs for safety before passing to LLM agents."""
    
    # Prompt injection patterns
    INJECTION_PATTERNS = [
        r'ignore\s+(previous|above|all)\s+(instructions?|prompts?|rules?)',
        r'you\s+are\s+now\s+',
        r'forget\s+(everything|all|your)',
        r'system\s*prompt',
        r'(tell|give|show|reveal)\s+me\s+the\s+answer',
        r'what\s+is\s+the\s+(correct|right)\s+answer',
        r'pretend\s+(you|to\s+be)',
        r'act\s+as\s+(if|a)',
        r'jailbreak',
        r'DAN\s+mode',
        r'\[\s*SYSTEM\s*\]',
        r'<\s*system\s*>',
    ]
    
    # PII patterns (US-focused for student data)
    PII_PATTERNS = [
        r'\b\d{3}-\d{2}-\d{4}\b',           # SSN
        r'\b\d{3}\s\d{2}\s\d{4}\b',          # SSN with spaces
        r'\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b',  # Email
        r'\b\d{10}\b',                         # Phone (10 digits)
        r'\b\(\d{3}\)\s?\d{3}-\d{4}\b',      # Phone formatted
        r'\b\d{1,5}\s+[A-Za-z]+(\s+[A-Za-z]+)*\s+(St|Ave|Blvd|Dr|Rd|Ln|Way|Ct)\b',  # Street address
    ]
    
    # Inappropriate content keywords (age-appropriate)
    INAPPROPRIATE_KEYWORDS = [
        'kill', 'suicide', 'self-harm', 'cutting', 'die',
        'weapon', 'gun', 'bomb', 'drug', 'alcohol',
        'sex', 'porn', 'nude', 'naked',
        # Add more based on school policy
    ]
    
    def __init__(self):
        self.injection_regex = [re.compile(p, re.IGNORECASE) for p in self.INJECTION_PATTERNS]
        self.pii_regex = [re.compile(p) for p in self.PII_PATTERNS]
    
    def filter_input(self, student_input: str, context: str = 'practice') -> FilterResponse:
        """Filter student input for safety. Returns sanitized input or block reason."""
        
        if not student_input or not student_input.strip():
            return FilterResponse(
                result=FilterResult.SAFE,
                original_input=student_input,
                sanitized_input='',
                reason=None
            )
        
        text = student_input.strip()
        
        # Check for prompt injection
        for pattern in self.injection_regex:
            if pattern.search(text):
                return FilterResponse(
                    result=FilterResult.BLOCKED_INJECTION,
                    original_input=text,
                    sanitized_input=None,
                    reason=f'Input matched prompt injection pattern'
                )
        
        # Check for PII
        for pattern in self.pii_regex:
            if pattern.search(text):
                # Redact PII rather than blocking entirely
                sanitized = pattern.sub('[REDACTED]', text)
                return FilterResponse(
                    result=FilterResult.BLOCKED_PII,
                    original_input=text,
                    sanitized_input=sanitized,
                    reason='PII detected and redacted'
                )
        
        # Check for inappropriate content
        text_lower = text.lower()
        for keyword in self.INAPPROPRIATE_KEYWORDS:
            if keyword in text_lower:
                # Flag for counselor review if self-harm related
                if keyword in ['suicide', 'self-harm', 'cutting', 'die']:
                    # Trigger alert (handled by caller)
                    pass
                return FilterResponse(
                    result=FilterResult.BLOCKED_INAPPROPRIATE,
                    original_input=text,
                    sanitized_input=None,
                    reason=f'Inappropriate content detected'
                )
        
        # Check if response is plausibly on-topic (very basic heuristic)
        # In practice mode, responses should be short answers, numbers, or letters
        if context == 'practice' and len(text) > 500:
            return FilterResponse(
                result=FilterResult.BLOCKED_OFF_TOPIC,
                original_input=text,
                sanitized_input=text[:500],
                reason='Response exceeds expected length for practice mode'
            )
        
        return FilterResponse(
            result=FilterResult.SAFE,
            original_input=text,
            sanitized_input=text,
            reason=None
        )


# Usage in the main API endpoint:
# safety_filter = StudentInputSafetyFilter()
# filter_result = safety_filter.filter_input(student_response, context='practice')
# if filter_result.result == FilterResult.SAFE:
#     # Proceed with agent processing
# elif filter_result.result == FilterResult.BLOCKED_PII:
#     # Use sanitized input, log PII attempt
# else:
#     # Return friendly message to student, log the block