Embeds the built player from its own origin in a
sandbox="allow-scripts allow-same-origin" iframe and drives
it over the schema-validated postMessage protocol. This host is a thin
authenticated proxy to the real deployed platform4; the
M2M credential stays server-side and the player only ever receives an
attempt-bound runtime token.
Cognito-gated demo. Use the operator account for this environment.
Upload a QTI zip package (imsmanifest.xml + item/test XML). It goes
through the real platform doors:
POST /qti/content-packages/upload-slots → presigned S3
PUT → POST /qti/content-packages/import-zip. A sample
package ships in this repo at demo/sample-package/.
Answer the item, then click the player's own
Submit button — the protocol has no
host→engine submit message; submit is triggered inside the
sandbox and reported back as SUBMIT_RESULT.
No submit yet.
null