Open infrastructure for computing education

EduCloud

An open-source, self-hostable platform for teaching with code — assignment distribution, sandboxed autograding, an AI tutor that cannot hand out solutions, and model routing that keeps student data on infrastructure your institution controls.

What it is

Infrastructure you own, not infrastructure you rent

The tools computing courses depend on are mostly rented. Student data sits on commercial terms, roadmaps follow someone else's market, and a product retirement can end a course workflow on a schedule you did not choose.

EduCloud exists so institutions own that layer instead. It is five modules under one umbrella, and they are designed to work independently — you can run the classroom layer on its own and never touch the rest. Each further module is a deployment step, not a migration.

It is community-owned and vendor-neutral by construction: the Git host is a plugin, the compute provider is a plugin, the model behind each routing alias is configuration, and the tutoring domain is a pack. No single vendor is a hard dependency anywhere in the stack.

Where to start

Cairn is the Classroom analogue

If you are leaving GitHub Classroom, Cairn is the piece that replaces it: assignments distributed to per-student Git repositories, collected, and graded in sandboxed containers, with an instructor dashboard.

Being straight about where it stands, because the calendar is short and you are making a real decision:

  • Working today. Classrooms and assignments from template repositories, student self-claim join, idempotent repo provisioning, deadline auto-locking, sandboxed container autograding with resource limits, CSV score export, and the instructor console.

  • Host-agnostic, end to end. GitHub, GitLab, and self-hosted Forgejo or Gitea all sit behind one adapter interface. A single deployment can serve classrooms on different hosts at once.

  • Privacy by architecture. The server stores Git usernames — not student names, SIS identifiers, or plaintext emails.

  • Not built yet: automated Classroom import. The one-command migration from an existing Classroom is still on the pilot list, not shipped. Roster import today is CSV.

  • Also outstanding: self-diagnostics, a hardened one-command deploy, completed student-facing views, and the end-to-end migration guide.

So: the classroom workflow runs, and the migration tooling does not exist yet. If you need a turnkey path in the next three weeks, plan on a manual setup with CSV rosters. The first full pilot runs a real course section in Fall 2026.

Architecture

Five modules, adopted one at a time

The names come from hiking and climbing, and they are chosen to describe the job each one does. Nothing below requires anything else below it.

  • Cairn a stacked trail marker

    The classroom layer, and the direct GitHub Classroom analogue. Assignments to per-student repositories, collection, sandboxed container autograding, instructor dashboard. Host adapters for GitHub, Forgejo and GitLab.

    Go + ReactCore workflow built

  • Belay the rope that catches a fall

    The peer AI tutor. A deterministic gate runs every draft through the domain grader and strips solutions before the student sees it, so the tutor cannot leak an answer even if asked well. Grades are invisible to it by policy.

    PythonFramework builtInstructor mode pending

  • Waypoint a fixed point you navigate by

    Publishing and federation — the hosting engine, institutional identity, and the tenant onboarding contract, plus a catalog for discovering course artifacts across institutions.

    Coolify + KeycloakStack proven locally

  • Portage carrying the boat between waters

    Model routing. An open-weight-first ladder decides where each AI call runs, with deterministic verification at each step. Student-facing lanes are configured so that no external provider exists in them at all.

    Python + LiteLLMRouting built

  • Outfitter who supplies the gear

    Compute brokering. One API to place course workloads — grading jobs, student environments, batch runs — on campus HPC, national research infrastructure, or containers, always under an explicit budget ceiling.

    GoSpecified, not yet built

How they fit

Each layer is optional except the one you start with

Read top to bottom: people at the top, the infrastructure they never see at the bottom. An instructor running only Cairn stops after the second row.

EduCloud architecture and its trust boundary Instructors and students interact with modules running on infrastructure the institution controls. Inside that boundary sit Cairn, Belay, Outfitter, Portage and Waypoint. Cairn exchanges repositories and commits with external Git hosts; Outfitter places jobs on external compute under a budget ceiling; Portage sends prompts to open-weight model endpoints, with commercial APIs reachable only from staff lanes. Only Git usernames are stored, so nothing student-identifying crosses any of those connections. A full text description follows the diagram. Instructors Students Runs on infrastructure you control Cairn Start here Assignments to per-student repos; sandboxed grading ✓ Belay Optional Peer tutor; a leak gate strips solutions ✓ Outfitter Optional Places jobs under a budget ceiling ✓ Portage Optional Routes every AI call by policy ✓ Waypoint Substrate Hosting and institutional sign-in for what you deploy Git hosts GitHub · GitLab Forgejo · Gitea Pluggable Compute Campus HPC · cloud Jetstream2 · containers Pluggable Open-weight self- or sovereign-hosted Commercial APIs staff lanes only repos + commits jobs, budget-capped prompts Only Git usernames are stored. No student names, SIS identifiers or plaintext emails exist anywhere in the system — so nothing student-identifying crosses any arrow above. ✓ Deterministic gate — a runner decides whether something worked. A model's own report is never sufficient. EduCloud architecture and its trust boundary The same architecture stacked vertically for narrow screens. A full text description follows the diagram. Instructors Students On your infrastructure Cairn Start here Assignments to per-student repos; sandboxed grading ✓ Belay Optional Peer tutor; a leak gate strips solutions ✓ Portage Optional Routes every AI call by policy ✓ Outfitter Optional Places jobs under a budget ceiling ✓ Waypoint Hosting and institutional sign-in Git hosts GitHub · GitLab Forgejo · Gitea Models open-weight first; staff-only for APIs Compute HPC · Jetstream2 containers Only Git usernames are stored. No student names, SIS identifiers or plaintext emails exist anywhere in the system. ✓ Deterministic gate — a runner decides, not a model.
Each module is optional except the one you start with. Adding another is a deployment step, not a migration of what already runs.
Read the architecture as text

The platform in six layers, from the people using it down to the hosting substrate.

Instructors & studentsthe only people involved Push code, get feedback, ask the tutor for help, see scores.
Cairnstart here — the classroom layer Distributes assignments to per-student Git repos, collects them, grades in sandboxed containers, exports scores. Runs standalone. This alone replaces GitHub Classroom.
Belayoptional The peer tutor sits beside the coursework. Its leak gate is deterministic, so it cannot reveal a solution regardless of how it is prompted.
Portageoptional Every AI call from any module routes through here. Policy decides which infrastructure is even reachable for a given lane — student lanes contain no external providers.
Outfitteroptional Places grading jobs and student environments onto whatever compute you have, under a budget ceiling with per-course cost attribution.
Waypointhosting & identity Hosts whichever modules you deploy and provides institutional sign-in. At federation scale, each site keeps its own registry.

The design rule

Nothing is trusted to grade itself

No module trusts a model's — or a vendor's — report of its own success.

Cairn's autograder, Belay's leak gate, Portage's verification step, and Outfitter's budget guards are the same idea applied four times: a deterministic runner decides whether something worked. A model saying it worked is never sufficient.

This is the part that is genuinely hard to retrofit, and it is why the platform is built the way it is rather than as a thin wrapper over an API. It is also what makes claims about it checkable: efficiency and quality claims are measured against a preregistered benchmark rather than asserted.

Status

Where the project actually is

Cairn's core workflow and all three host adapters are built; the migration tooling and deploy polish are the active work. Belay's framework is complete with a large deterministic test baseline, and instructor mode is its remaining product gap. Portage's routing spine is built and running as a working deployment. Waypoint's stack is proven locally and awaits a provisioned server. Outfitter is fully specified and implementation has not started.

A pilot course section runs in Fall 2026. Everything is Apache-2.0 with a Developer Certificate of Origin, documentation is CC BY, institutions self-host, and there are no per-seat fees.

Getting involved

Three ways in

Instructors — pilot Cairn as your classroom layer, and tell me where it breaks. Institutions — flagship deployments and federation pilots. Contributors — the plugin boundaries (Git hosts, compute providers, tutoring domains) are the intended entry points.