Everything Zayeed does
Grouped by the package it lives in, because that is also the boundary it is tested at. Nothing here is a platform-specific feature: if it is in the engine, every shell has it.
Grading engine
The part everything else is arranged around. It is a pure library: an expression grammar, a tolerance pipeline, a scoring model and a session state machine, with no I/O and no platform assumptions.
- Nested boolean answer expressions — AND, OR, NOT and grouping over accepted answers, not a flat list of alternatives.
- Synonym groups — one concept, many surface forms, declared once and reused across items.
- Declared part counts — "any three of these five", marked as three separate credits rather than one all-or-nothing string.
- Ordering sensitivity — sequence matters when the author says it does, and is ignored when it does not.
- Partial credit and negative marking — per item, per part, with the arithmetic shown.
- A tolerance pipeline — whitespace, case, punctuation, accents, typo distance and numeric tolerance, each a stage that can be turned off.
- A single leniency control — the stages are ordered so one slider moves the whole pipeline coherently.
- Reasons, not just scores — every mark carries what matched and why, which is what an appeal actually needs.
- Question sets — a paper is assembled from named sets with their own item order and selection.
- A capability-scoped rule layer — branch, flag, message, media, navigation and declared webhooks. Nothing else is expressible.
- Deterministic randomisation — a seeded generator, so a shuffled paper can be reproduced exactly at appeal.
- A session state machine — a pure reducer over an event log: started, answered, cleared, bookmarked, navigated, paused, resumed, branched, submitted. Replay the log, get the state.
- Access arrangements — see the accessibility page; they are engine-level, not a settings screen.
Document model
- Blocks, runs and marks — one model shared by the question, the accepted answers and the candidate's response.
- Maths — written, stored and compared as structure rather than as an image of structure.
- RTF import — paste from the word processor the question bank has been living in.
- Marked-text editing — the author marks which formatting is significant, inline, in the text itself.
- Formatting-sensitive comparison — H₂SO₄ and H2SO4 differ only if the author declared that they do.
Pack format
- .mcq container — a portable, offline, self-contained exam pack: items, media, rules, sets and the on-screen keyboard layout, in an encrypted binary container whose directory is encrypted too.
- Specified, not just shipped — a written specification and published test vectors, so a reader can be implemented from the specification alone, in any language.
- Per-pack keys in slots — a passphrase, a colleague's public key, this device, an entitlement, or an exam-window key. No global key, and none compiled into any binary.
- Plaintext export is guaranteed — a build gate asserts that anyone who can open a file can always export it in the clear. Encryption protects a paper from a candidate, not an author from us.
- Opens what came before — the
.mcqxZIP and legacy MCQPro Access banks, decided by reading the bytes rather than by the extension. - A lossless bridge — pack to database and back with nothing dropped in either direction.
- Media travels inside — a pack handed over on a memory stick opens on a machine with no network and nothing missing.
On-screen keyboard
- Unicode-first — a key emits a string, not a key code, so one key types a combining mark or a whole cluster.
- Named levels — shift, alt-graph and author-defined levels have names rather than numbers.
- Direction-aware — right-to-left layouts are a property of the layout, not a fork of the component.
- Four built-in layouts — Latin, maths and chemistry, IPA, Bangla. Nothing has to be configured to use it.
- Travels in the pack — a custom layout ships with the exam that needs it.
Analytics
- Facility and discrimination per item.
- KR-20 reliability for the paper.
- Distractor analysis — which wrong option is doing the work, and which is dead weight.
- Attempt series — the same candidate over time, and the same item over cohorts.
- Recomputed, never cached — the numbers come from the stored attempts each time they are shown. An item's saved statistics change only when a person asks for it.
- Time on each question — replayed from the session log rather than a stopwatch in the player, so it survives a reload, a crash and a sitting paused for a fire alarm. Paused time is not counted and a question never displayed carries no time rather than a zero.
- Equating between two forms — mean/mean, mean/sigma, Haebara and Stocking–Lord, with the anchor found by intersecting the two papers rather than nominated, drifted anchors named and set aside, and the constants shown as what they do to a real measure. Nothing is rescaled automatically: operating from a link is a judgement somebody signs for.
Database and sync
- One schema definition generating both SQLite and Postgres, with a parity test that fails if they drift.
- Full local replica on every shell — the app is never waiting on a server to show you your own library.
- HLC-ordered operation log — hybrid logical clocks order writes across devices that disagree about the time.
- Settings are rows — org, user, device and pack scopes resolved in that order, so a preference set on the laptop is already set on the phone.
- Pairing by six-digit code, and join-by-code for a candidate with no account at all.
- Three ways to travel, one merge rule — an account over the network, two devices on the same local network with no server at all, or a
.mcqbundle carried on a memory stick. All three end in the same rows, because only one of them decides anything. - A bundle merges, it does not overwrite — it carries the changes the other device has not seen, so applying it twice does nothing the second time.
- Convergence tested — three replicas take thousands of randomly interleaved and partitioned writes, then sync to quiescence and must end byte-identical.
Interoperability
- QTI 3.0 import and export, with per-item notes where a construct does not map, instead of silent loss.
- LTI 1.3 — Deep Linking, launch and Assignment and Grade Services. See Integrations.
- Self-hosting — point the server at your own Postgres and it is your data, on your estate.
Import
- Nine kinds of question bank — spreadsheets and CSV, Moodle XML, GIFT, Aiken, QTI,
.mcqand.mcqxfiles, legacy MCQPro Access banks, and questions pasted into a box. - Read by their bytes, not by their extension, so a renamed file still opens as what it is.
- Reviewed before anything is written — see what it would add, update and leave alone, then decide. The commit step takes the reviewed preview, so a screen cannot skip the review.
- Nothing is dropped quietly — every record a reader could not use is reported with the place it came from, down to
bank.csv row 4. - Re-import updates rather than duplicates — identity is derived from the source, so a corrected export mends the questions you already have instead of making a second bank.
- Legacy banks need no Windows — Access 97 and Access 2000 files are read directly, with no Jet driver and no ODBC, including the old expression tree and text-replacement table.
Certificates
- Signed over their own fields with the awarding body's Ed25519 key — so an employer with no network, no account and no permission from us can check one from the file and a public key alone.
- A PDF written byte by byte, not by a browser: the font travels inside the document, so a name in Bangla or Arabic prints as its owner spells it, and the same certificate renders to identical bytes twice.
- A reason, not a verdict — withdrawn, expired, altered and "I have never seen this issuer's key" are four different things to tell a person, and only one of them is an accusation.
- Withdrawal is signed too — anyone can write a list claiming your certificates are void; an unsigned or foreign-signed one is ignored.
- Who qualifies is one rule, applied by the same function that explains each refusal beside the candidate it concerns, and by the batch signer.
Getting work onto another machine
- Three routes, one merge rule — an account over the network, two devices on the same local network with no server at all, or a file carried by hand.
- Confirmed once — a first pairing shows six digits on both screens. If they differ, something is relaying the connection, and the screen says to stop.
- Sealed and replay-proof — a repeated or reordered frame is refused, because a repeated "push these changes" is how two copies of a library are made to disagree.
- A bundle merges, it does not overwrite — it carries changes rather than a snapshot, so applying it twice does nothing the second time.
- An exam paper can be sealed to its sitting — distributed a week early, unreadable until the invigilator releases the key, with every early release recorded against a name and a reason.
What is not built yet
Everything above this heading is implemented and ships in the builds you can download today. Everything below it is not, and is listed here for the same reason the rest of the page exists: a feature list that mentions only what works is read as a claim that everything else works too.
| Capability | State | Where it stands |
|---|---|---|
| Code signing | Not done | The Windows, Linux and Android builds are real installers. The Android package is signed with our own release key, but no build carries a purchased code-signing certificate and none is distributed through a platform store, so the operating system will ask you to confirm the install. Every file is published with its SHA-256 so you can check it yourself, and every shell can now check a download against a signed release list instead of a printed number — against a key compiled into it, not one fetched from this site. That key is published and pinned: id b46538f1336eacf8, with the manifest at /dl/release.json. It proves the file is the one that was built, not who built it, which is what a certificate would add. See Downloads. |
| macOS | Written, not bundled here | The same C# application, published for Apple silicon and for Intel, wrapped in a .app bundle by ops/bundle-macos.sh — which has to run on a Mac, because an executable bit, a bundle layout and the ad-hoc signature Apple silicon requires do not survive being produced anywhere else. No bundle has been built or tested on Apple hardware here, so none is offered on Downloads; it is unsigned and un-notarised, and macOS refuses a first double-click of such an application outright. |
| Billing | Priced, invoiced, no card | Every shell now shows the licence a device holds — what it covers, what the plan costs, how its seats are counted, when it renews — and one plan catalogue feeds the applications, the feature data and the pricing page alike, so a figure cannot appear on this website unless the identical figure is in the software. What is missing is one specific thing: a payment provider. The port exists, its only implementation quotes correctly from the published list and refuses to open a checkout, and a licence is therefore bought on an order form and invoiced — which is how Inspera, Cirrus, Surpass and ExamSoft all sell in any case. The licence-issuer key is pinned — id 5dee02756404b46a, separate from the release-signing one — so a token issued for it reads the same in every shell, and a token signed by anything else reports that it cannot be checked here rather than being guessed at. Going over a seat ceiling is a finding and an invoice question, never a locked door; marking is never gated by a licence in any plan, and a lapse closes paid features without closing papers, marking, results, certificates already issued or export. Both of those are tests on both platforms, not intentions. |
| Sync between buildings without an account | Partial | On one network segment two devices find each other and sync directly. Between buildings they meet at a rendezvous relay: nine characters read down the phone, two seats per code, sealed frames the relay cannot read and nothing kept afterwards. No relay is hosted for the public, so that route needs the server component running somewhere you control. |
| Device discovery on web and Android | Partial | Seeing another device directly needs a multicast socket. The Windows, Linux and Android applications have one; a browser tab cannot have one, so the web shell uses a carried file or a meeting code — which carry exactly the same changes. |
| iOS | Not built | The Android source is cross-platform, but no iOS build has been produced or tested. |
| Biometric identity verification | Not built, and not planned | Camera, microphone and screen supervision is built, on all four platforms, running on the candidate’s own machine — see Proctoring. What it does not do is say whose face it was: nothing is compared against a passport, a driving licence or a photograph on file. A sitting establishes that a face was present and that the face in view did not change, which is a different and smaller claim, and the review states it in those words. A third-party provider can still be booked for an identity check, and a review then names which capability came from whom. |
| Live human invigilation | Tools built; staff are yours | The screen an invigilator watches a live hall on is built — every sitting being sat, ordered by who needs a human, with the attention ratio against a stated 25 sittings per invigilator printed on it, and six things a named person may do to a sitting while it runs, each carrying their reason into the same hash chain as the recording (Live monitoring). What is not here is the workforce: a person watching a candidate in real time is staffed, not coded, and this product does not staff one. A sitting can be booked against a proctoring service the centre contracts itself — the request out, the signed webhook back, its events folded into the same timeline marked with their source, and the same review desk where a named person records a decision against a cited moment. We resell no provider; a centre brings its own contract and its own credentials. A human invigilator in a hall is a provider too, and so is ‘none’, because a sitting with no arrangement and a sitting whose arrangement failed must not look the same in a report. |
| Screen supervision on Wayland | Refused by the desktop | On a Wayland session no application is permitted to read the screen — that is the point of Wayland’s isolation, and it is a decision of the desktop rather than a fault here. The screen stream is refused in those words, the camera and microphone carry on, and the readiness screen says what is missing. An X11 session, which is still what most managed Linux estates run, works. |
| A listing in anybody’s store | Not done | All five panels exist — PowerPoint, Google Slides, Teams, Zoom and Webex — and none of them is published in the Office store, the Teams catalogue, the Zoom Marketplace or Webex App Hub. Each is created against your own account from the manifest published beside it, which takes an administrator ten minutes and is also what keeps the deck, the answers and the names on your own relay. See Integrations. |
| A mail relay of our own | By your relay, not ours | Candidate notices are delivered — through the institution’s own SMTP relay, or a signed webhook on its own side, and through nothing at all until one of those is described. No relay is hosted here and Zayeed is never the sender: it has no address, no sending domain and no reputation of its own to lend to somebody else’s examination timetable. So a centre with no mail system still has the portal and the API as the delivery mechanism, and there is no SMS channel, no push notification and no templating. See Telling the candidate. |
| Booking with no network | By design | All four shells book, move and give up seats, and none of them can do it offline. A desk in a hall depends on every other candidate in it and only the server knows about them, so an offline application shows the timetable it last heard, dated, with the booking controls withheld and the reason in a sentence. Nothing is queued for later: a queued booking is a promise about a desk the device cannot see. See Booking the seat. |
| AI authoring and grading | Not built | No generative authoring and no AI-assisted marking. Marking is deterministic and stays that way. |
| Content marketplace | Not built | No shared item bank between customers. |
| WCAG 2.2 AA audit | Self-assessed, not audited | All 55 Level A and AA criteria are claimed one at a time in a published conformance report, and most of those claims are enforced by a check that fails the build. No independent audit has been carried out: an auditor would test with real assistive technology in the hands of people who depend on it, and would find what no check can see. |
Write one question. Mark it four ways.
Run the Windows or Linux application, open the browser app, or scan into the Android shell. They are the same library, the same marks and the same rules — with or without a network.