Training exports

Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment.

Reads training records exported by your learning management system, row by row, from a bucket prefix or a drop folder your deployment mounts, read-only.

At a glance

Collector	Training exports, version 1.0.0
Reads	Any learning management system: LMS training-record exports (the vendor's documentation)
Family	Aviation
Kind	Training
Ways to connect	None (no credential), Service account
Scopes	Read:
Read only	Yes
Vendor's API can move money	No
Personal data	Identity, Contact, Employment
Hosts it may contact	Only the hosts on your deployment's allow-list (*: the host is the one you give it)
Vendor API versions	CSV and JSON exports (no vendor API)
Lowest engine version	0.46.0

What it reads

• Every .csv file (and .json list of objects) under the prefix you name: each row is one record, keyed by id_columns and titled by title_columns.
• An LMS exports completions as files; this collector reads those files and never connects to the LMS. For xAPI learning record stores see the xapi collector.

How to connect

1. Make the export write to a bucket prefix, or to an SFTP server whose landing directory the deployment mounts.
2. Your engineer sets this source up in the source card (there is no key to paste): store (s3://bucket/prefix/, gs://, azblob:// or file:/path), id_columns (what identifies a row), title_columns (the fields joined for the title), and for S3 a role_arn (and external_id, region).
3. Give the role read access to that prefix only. In LightHouse the card reads Read.

Permissions

• No credential is stored. The deployment’s identity, or the role it assumes, is the permission; grant list and get on the one prefix and nothing else.
• The collector only lists and reads objects (and, for a file: store, reads files). It never writes, moves or deletes an export. Its read-only test uses a stub S3 client that records every operation and fails on any but list and get, and checks that a drop folder is byte-for-byte unchanged afterwards; there is no HTTP to record.
• Nothing here connects to the system that produced the export, so nothing here could change it.

Limits

• Only files ending .csv or .json (a list of objects) are read; others are ignored.
• A file is read again only when its ETag changes. Files larger than max_mb (50 by default) are skipped and counted.
• Column names are the export’s own and none is assumed: set id_columns (otherwise a row’s hash is its id, so an edited row becomes a new record and the old one is withdrawn) and title_columns.
• Rows that leave a file, and files that are removed, become withdrawals.
• Google Cloud Storage and Azure Blob stores are read through the engine’s adapters, which need their own identity libraries in the deployment.

Data handling

• Records are read and indexed inside your deployment. LightHouse receives ids, hashes and counts, never a row.
• Training exports name the trainee. Leave the name out (exclude_fields) where records are read for trends rather than people.
• Contact fields and reporter names are left out by default, as are travel document numbers and dates of birth. exclude_fields adds columns (for example **.Captain); keep_fields takes a default back by its exact name. Nothing is cached raw.

Troubleshooting

What you see	What it means	What to do
a source needs its label	No label was given	Give the source a label
the store's prefix is a plain path	The prefix holds characters a path cannot	Use a plain prefix
Read succeeded, nothing written	No file’s ETag has changed since the last read	Nothing to do
Fewer rows than expected	A file over max_mb was skipped (the source counts them)	Raise max_mb, or split the export
A title of the form <kind>: <file>#<hash>	title_columns is not set, or its columns were empty	Name the columns for the title
Rows reappear as new records	id_columns is not set, so ids are row hashes	Name the columns that identify a row

Certification

Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See How collectors are certified.

Date	Collector	Engine	Vendor API	Method	Expires
10 November 2026	1.0.0	0.47.0	CSV and JSON exports	Fixtures only: built, not certified	Not applicable

Security posture

From the collector’s last scan on the default branch. What each line means, and what blocks a release: Security posture.

Last scanned	10 November 2026
Critical findings	0
High findings	0
Medium findings	0
Low findings	0
Info findings	0
Release blocked	No
Network allow-list check	Pass
Read-only behavioural test	Pass
SBOM (CycloneDX)	Produced
Dependency licences	Pass
Scanners	bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only