LTI 1.3, Autograding, Subgroups and Templates for CircuitVerse | GSoC 2026 | Final Report

Description and use

CircuitVerse upgraded its LMS integration from LTI 1.1 to LTI 1.3, adding grade passback, deep linking, roster sync, autograding, subgroups and circuit templates.

Problem

CircuitVerse needed to upgrade its LMS integration from deprecated LTI 1.1 to LTI 1.3 and add grade passback, deep linking, roster sync and autograding.

Outcome

Over 22 weeks, 44 pull requests were opened; six merged, including the core LTI 1.3 handshake. The project added robust grade passback, deep linking, roster sync, autograding, subgroups and circuit templates, improving integration with LMSs and automating grading workflows.

Workflow

• 1. Split LTI 1.3 implementation into 24 small pull requests for reviewability
• 2. Implement JWT validator with strict algorithm enforcement and key rotation handling
• 3. Sign state as a signed token to avoid session dependency
• 4. Add OIDC login endpoint and secure CSRF handling
• 5. Implement grade passback via Assignment and Grade Services
• 6. Add deep linking support for embedding content
• 7. Implement roster sync to create CircuitVerse groups from LMS class lists
• 8. Build autograding pipeline with test suite editor and grading pipeline
• 9. Add subgroup (team) support within groups
• 10. Create circuit template library for reusable designs

Evidence

I set out to move CircuitVerse's LMS integration from LTI 1.1 to LTI 1.3 and to add four things on top of it: grade passback, deep linking, roster sync and autograding.

Source

The proof of concept signed users in with User.find_by(email: payload["email"])… The fix keys identity on the sub claim, scoped to the deployment it came from.

Source

Most of its tests are attacks: a token signed by the wrong key, alg: none, an expired token, the wrong issuer or audience, a replayed nonce, and algorithm confusion.

Source