Architecture

MTP is a small set of services in their own Kubernetes namespace (mtp), consuming the HOPE Metahuman Service across a hard product boundary and Google APIs through restricted private endpoints (no internet egress).

The services

Service	Stack	Purpose
`api`	NestJS 11 on Fastify	Control plane and sole database owner: tenancy, auth/SSO/SCIM, the content kernel, LMS, LTI, HOPE connection management, webhooks, metering, audit
`session-gateway`	NestJS 11 on Fastify	Real-time broker between the browser and HOPE’s speech and agent streams; composes run envelopes server-side; records the authoritative transcript
`web`	Next.js 15 / React 19	The single portal, route-grouped for learners, authors, tenant admins, and the platform owner
`assessment-engine`	Python 3.12 / FastAPI	Post-session single-pass assessment: transcript + rubric + ground truth in, one unified assessment payload out
`curriculum-engine`	Python 3.12 / FastAPI	Document extraction, retrieval indexing, and personalized curriculum plan generation
`docs`	Nextra 4 static export	This site

Two integration principles

Everything about the shape of the system follows from two rules:

1. MTP is a HOPE customer, not a sibling

Nothing crosses the MTP/HOPE boundary except HOPE’s public contract: the runtime plane (token exchange, the /agent-stream and /stt WebSockets, live-avatar sessions, inbound signed webhooks) and the administration plane proxied by Metahuman Studio (metahumans, avatars, voices, guardrails, workflows, datasets). No shared database, no shared code, no internal endpoints, and no HOPE feature is ever re-implemented in MTP’s backend. MTP-to-HOPE traffic even goes through HOPE’s public ingress, exactly like any other customer, to keep the contract honest.

2. MTP owns the truth layer

A scenario’s ground truth — which persona fields are deceptive, what the actual values are — must never reach the browser. A trainee with dev tools open would otherwise see the answers. The run envelope that HOPE receives is therefore composed server-side in the session-gateway, from stated values only. This single constraint dictates the gateway architecture; Training sessions covers the resulting contract in detail.

Where things run

All MTP workloads deploy to the same GKE Autopilot cluster and GCP project as HOPE, in a separate mtp namespace with NetworkPolicy isolation. MTP gets its own Cloud SQL Postgres 16 instance, its own Redis, its own KMS keyring, and its own GCS buckets — independent blast radius from HOPE where that is cheap. All Google API access (Vertex AI, Document AI, KMS, Secret Manager, GCS) goes through restricted private endpoints; the platform has no internet egress.