# DRAFT RESPONSE — AI-Assisted EAL Benchmark Assessment Application ### NimbleStride Inc. / MGR Infotech ### Prepared for: Alberta Purchasing Connection (APC) — E-Submission Only ### Submission Channel: http://vendor.purchasingconnection.ca/ --- > **DRAFT STATUS NOTICE:** This document is a working draft for human review and completion before submission. All `[PROVIDE: ...]` and `Beyond in-Canada data residency, NimbleStride confirms: data encrypted at rest (AES-256) and in transit (TLS 1.2+), role-based least-privilege access controls, and full audit logging as standard practice. Please confirm whether the SOW mandates additional requirements such as Protected B cloud controls (CCCS Medium profile), personnel security screening (reliability or secret clearance), or a specific certified environment (e.g., SCED Level 2/3) so those can be attested or arranged.` markers must be resolved. Do not submit with placeholders outstanding. All content must be in English only (SOW p.24). --- # 1. Cover Letter **Date:** [PROVIDE: insert submission date] **To:** SOW Procurement Official Alberta Purchasing Connection (APC) [PROVIDE: insert Procurement Official name and contact details from APC posting] **Re:** Response to SOW — AI-Assisted EAL Benchmark Assessment Application **APC Posting Reference:** [PROVIDE: insert APC posting/solicitation number] --- Dear SOW Procurement Official, NimbleStride Inc. (Alberta) and MGR Infotech (Saskatchewan), operating together as a single bidding entity under the legal name **NimbleStride Inc.**, are pleased to submit this Response to the above-referenced Statement of Work for the AI-Assisted EAL Benchmark Assessment Application. NimbleStride Inc. is the prime Contractor for this Response. The single point of contact for all clarifications and communications is: **Mohammed Yousuf Shariff** NimbleStride Inc. / MGR Infotech 1209 Waterford Dr, Chestermere, AB T1X 3A1 Phone: +1 (613) 407-0895 Email: support@nimblestride.ca We confirm that this Response: - Is submitted exclusively via the APC E-submissions platform in accordance with SOW Sections 4.3 and 4.4; - Is in English only; - Includes a completed Submission Form (Appendix A); - Includes pricing in the format required by Appendix B, Section 3; - Addresses all Mandatory Requirements in Appendix B, Section 1; - Discloses no actual, possible, or perceived conflict of interest at this time [CONFIRM: verify no conflict of interest exists for NimbleStride Inc., MGR Infotech, and all proposed subcontractors/associates before signing]; and - Does not involve any political or other lobbying to influence contractor selection. We acknowledge the non-binding nature of this procurement process and confirm our ability to provide Application Services as described in the AMSA PQR. Respectfully submitted, **Mohammed Yousuf Shariff** Principal, NimbleStride Inc. / MGR Infotech support@nimblestride.ca | +1 (613) 407-0895 --- # 2. Company Overview **Legal Name:** NimbleStride Inc. **Operating Name:** MGR Infotech **Entities:** NimbleStride Inc. (Alberta) and MGR Infotech (Saskatchewan) **Prime Contractor:** NimbleStride Inc. **Address:** 1209 Waterford Dr, Chestermere, AB T1X 3A1 **Phone:** +1 (613) 407-0895 **Email:** support@nimblestride.ca **Business Number:** [PROVIDE: CRA Business Number] **Corporate Registry Number (Alberta):** [PROVIDE: Alberta Corporate Registry number] **WCB Account Number:** [PROVIDE: WCB Alberta account number or confirm exemption] NimbleStride Inc. (Alberta) and MGR Infotech (Saskatchewan) together deliver custom software and AI development, web platforms, managed IT, Microsoft services, hardware supply, security systems, and cloud services across Alberta, Saskatchewan, and Manitoba. **Core technical capabilities relevant to this SOW:** - Custom software, web, and AI/LLM application development in TypeScript, JavaScript, Python, Next.js/React, and Node.js - Infrastructure-as-code with Terraform/HCL; Canadian-region cloud deployment (AWS ca-central-1) - AI/LLM integration; model versioning and governance - Production AI platforms designed and built: ClearBid (Canadian public-sector compliance-screening AI), ClearBind (AI InsurTech platform), an OSFI E-23 model-risk-management platform for Canadian FRFIs, and GridWitness (energy/carbon) - Microsoft 365/Azure, Active Directory setup and administration (MGR Infotech) - Agile/SAFe delivery led by SAFe SPC 6, CSM, and PRINCE2 Practitioner **Delivery model:** Principal-led engagement, with vetted part-time associate consultants engaged per project and scaled to the skills and size each engagement requires. --- # 3. Compliance Response — Mandatory Requirements > Requirements are grouped thematically below. Page citations are from the SOW as listed in the tender. --- ## 3.1 Submission & Format Requirements ### 3.1.1 E-Submission via APC Only (SOW pp.1, 20, 22) **Requirement:** Responses must be submitted exclusively via the APC E-submissions platform (http://vendor.purchasingconnection.ca/). Email submissions will not be considered. The APC system timestamp at successful submission is the official receipt time. Late submissions are not accepted. Uploaded files must pass system validations and security checks before a submission is considered received. Responses must be searchable and printable (excluding MP4/MOV). Content in external portals, web links, or embedded documents will not be evaluated. Ambiguous, unclear, or unreadable Responses will be rejected. Responses that cannot be opened will be rejected. **How we comply:** NimbleStride Inc. will submit this Response exclusively through the APC E-submissions platform before the SOW Closing Date and Time. All files will be submitted in standard, searchable, and printable formats (PDF and/or Word/Excel as appropriate). No content will be placed behind external links or embedded documents. We will allow sufficient time before closing for system validation and security checks to complete and a timestamp to be issued. [PROVIDE: confirm file formats and sizes comply with APC System Submission Rules published on the APC Help Centre before final upload.] ### 3.1.2 English Language (SOW p.24) **Requirement:** All Responses are to be in English only. **How we comply:** This Response is submitted entirely in English. ### 3.1.3 Completed Submission Form — Appendix A (SOW pp.19, 26) **Requirement:** Responses must include a completed Submission Form (Appendix A), including contractor information, eligibility, consortia information (if applicable), acknowledgement of non-binding procurement process, and ability to provide application services. One contact person must be named in Table 2. Eligibility must be confirmed in Table 3. **How we comply:** Appendix A is completed and attached to this submission. See Section 8 of this Response for the checklist of required forms. - **Table 2 — Contact for clarifications:** - Name: Mohammed Yousuf Shariff - Organisation: NimbleStride Inc. - Phone: +1 (613) 407-0895 - Email: support@nimblestride.ca - **Table 3 — Eligibility:** [CONFIRM: NimbleStride Inc. must confirm it is in Good Standing under AMSA and eligible to submit. Complete the applicable row in Table 3 of Appendix A. See also Section 3.2.1 below.] - **Table 4 — Consortia:** [CONFIRM: Is this Response from a consortium? If NimbleStride Inc. and MGR Infotech are submitting as a consortium, complete Table 4 for MGR Infotech as a consortium member. If NimbleStride Inc. is the sole legal entity and MGR Infotech is a trade name/division, confirm this in Appendix A and no Table 4 entry is required. Clarify legal structure before submission.] ### 3.1.4 Pricing Format — Appendix B, Section 3 (SOW pp.11, 19) **Requirement:** Responses must use Appendix B, Section 3 (or a similar representation of the same information) to submit pricing. Fixed Prices and Fixed Rates must be inclusive of all expenses including travel, workspaces, facilities, office supplies, equipment, applications, connectivity, telephone, and internet services. No termination fees may be included in the Fixed Price. **How we comply:** Pricing is provided in Appendix B, Section 3 format. See Section 7 of this Response. All Fixed Prices and Fixed Rates are all-inclusive as required. No termination fees are included. ### 3.1.5 Mandatory Requirements — Appendix B, Section 1 (SOW p.19) **Requirement:** Responses must meet or exceed all mandatory requirements in Appendix B, Section 1. **How we comply:** Each mandatory requirement is addressed in this Section 3 and in the experience examples in Section 6. ### 3.1.6 Conflict of Interest Disclosure (SOW p.24) **Requirement:** Contractors must fully disclose any actual, possible, or perceived conflict of interest for the Contractor or any proposed sub-contractor. **How we comply:** NimbleStride Inc. is not aware of any actual, possible, or perceived conflict of interest in relation to this SOW. NimbleStride Inc. confirms that all proposed associates and subcontractors will be reviewed for conflicts of interest prior to submission. Any identified conflict will be disclosed promptly and in writing to the SOW Procurement Official before the bid is filed, and ongoing conflict-of-interest monitoring will be maintained throughout the engagement. ### 3.1.7 No Lobbying (SOW p.25) **Requirement:** Contractors must not engage directly or indirectly in any form of political or other lobbying to influence contractor selection. **How we comply:** NimbleStride Inc. confirms it has not engaged and will not engage in any form of lobbying in connection with this SOW. ### 3.1.8 Questions and Concerns (SOW p.23) **Requirement:** Questions or concerns must be communicated in writing to the SOW Procurement Official at least 3 Business Days prior to the SOW Closing Date and Time. **How we comply:** Any questions arising from review of this SOW have been or will be submitted in writing to the SOW Procurement Official within the required timeframe. ### 3.1.9 Retraction and Resubmission (SOW p.22) **Requirement:** A Contractor may retract and resubmit their Response through APC prior to the SOW Closing Date and Time. Only the most recent, time-compliant submission will be considered. **How we comply:** Acknowledged. If a resubmission is required, it will be made through APC before the closing date and time. ### 3.1.10 False or Deceptive Information (SOW p.20) **Requirement:** The Province will disqualify a Response that submits false, deceptive, or fraudulent information. **How we comply:** All information in this Response is accurate and truthful to the best of NimbleStride Inc.'s knowledge. --- ## 3.2 AMSA Eligibility & Good Standing ### 3.2.1 AMSA Good Standing (SOW p.6) **Requirement:** This SOW is an open competition for Contractors who are in Good Standing under AMSA to provide Application Services as described in the AMSA PQR. **How we comply:** [CONFIRM: Is NimbleStride Inc. currently registered and in Good Standing under AMSA (Alberta Master Services Agreement for Application Services)? If not yet registered, this is a **critical eligibility gap** that must be resolved before submission. Provide AMSA registration/vendor number here.] --- ## 3.3 Data Residency, Sovereignty & Security ### 3.3.1 In-Canada / In-Alberta Data Residency (SOW pp.5, 19) **Requirement:** The environment must enforce strict in-Canada data residency for Protected A and Protected B data, and in-Alberta data residency for Protected C data. All records disclosed to the Contractor, including Personal Information, must be stored only in Canada (Protected A/B) or only in Alberta (Protected C). No access or disclosure subject to foreign laws or extraterritorial claims is permitted. **How we comply:** In-Canada data residency is standard practice across the NimbleStride product portfolio. All products are deployed on Canadian-region cloud infrastructure (AWS Canada Central / ca-central-1), with data stored and processed in Canada. Data is encrypted at rest (AES-256) and in transit (TLS 1.2+), with role-based least-privilege access and full audit logging. No data is subject to foreign extraterritorial claims. For Protected C data requiring in-Alberta residency specifically: [CONFIRM: Identify an Alberta-specific cloud region or data centre (e.g., Azure Canada East / Calgary, or a GoA-approved on-premises or co-location facility in Alberta) to satisfy the in-Alberta requirement for Protected C data. AWS ca-central-1 is located in Montreal/Montréal and may not satisfy in-Alberta residency for Protected C. Resolve before submission.] ### 3.3.2 Canadian Sovereignty & Personnel Security Clearance (SOW p.5) **Requirement:** Management, support, and security operations must be performed only by Contractor personnel who meet the Province's Canadian sovereignty and security clearance requirements. Support and management operations must be fully isolated. **How we comply:** Mohammed Yousuf Shariff (Principal) is based in Chestermere, Alberta, Canada. All delivery personnel will be Canadian residents. [CONFIRM: Do any proposed associates or subcontractors reside outside Canada? If so, this is a **mandatory compliance gap**. Confirm all personnel meet the Province's specific security clearance level requirements (e.g., Reliability, Secret) and provide evidence of clearances or a plan to obtain them. Confirm what specific clearance level the SOW requires.] ### 3.3.3 Security Incident Response (SOW p.15) **Requirement:** If a security violation or issue occurs, the Contractor must immediately initiate an incident report, notify the Corporate Information Security Office (CISO), and provide a root cause analysis. **How we comply:** NimbleStride Inc. will maintain a documented security incident response procedure. Upon detection of any security violation or issue, we will: (1) immediately initiate an incident report; (2) notify the Province's Corporate Information Security Office without delay; and (3) provide a written root cause analysis within the timeframe specified by the Province. NimbleStride Inc. proposes the following indicative incident response SLAs, subject to confirmation against the executed SSA: Critical/P1 incidents — initial notification within 1 hour, interim mitigation within 4 hours, root cause analysis (RCA) within 2 business days; High/P2 — notification within 4 hours, RCA within 5 business days. Final SLA timelines will be aligned to any specific figures mandated in the SSA upon execution. ### 3.3.4 Compliance Monitoring & Reporting (SOW p.17) **Requirement:** The Contractor shall monitor and report compliance with data residency and sovereignty requirements upon request by the Province. **How we comply:** NimbleStride Inc. will maintain continuous monitoring of data residency compliance through cloud infrastructure audit logs and access controls. Compliance reports will be provided to the Province upon request, in the format and within the timeframe specified. ### 3.3.5 Written Consents (SOW p.24) **Requirement:** The Contractor must provide written consents within 2 Business Days of a request by the Province. **How we comply:** NimbleStride Inc. acknowledges this requirement and will provide any requested written consents within 2 Business Days. --- ## 3.4 AI Governance & Explainability ### 3.4.1 Explainable AI (SOW p.17) **Requirement:** The Contractor shall ensure that all artificial intelligence-enabled processes are explainable in plain language. **How we comply:** All AI-enabled processes delivered under this engagement will be designed with explainability as a core requirement. Model outputs, scoring logic, and decision-support outputs will be accompanied by plain-language explanations accessible to non-technical users (teachers, administrators, and assessors). Explainability mechanisms will be documented and demonstrated during user acceptance testing. ### 3.4.2 AI Asset Documentation (SOW pp.17, 15) **Requirement:** The Contractor shall maintain up-to-date documentation of all AI and automation assets, including model versioning, training data references, workflow logic, and configuration details. Such documentation shall be readily available to the Province upon request. **How we comply:** NimbleStride Inc. will maintain a living AI Asset Register covering: model name and version, training data provenance and references, workflow logic descriptions, configuration details, and change history. This register will be stored in the Province's designated GitHub repository (or other repository identified in writing by the Province) and kept current throughout the Term. It will be made available to the Province upon request without delay. ### 3.4.3 AI Governance Capabilities (SOW p.30 — Mandatory Experience Requirement 7) **Requirement:** The Contractor must demonstrate experience implementing AI governance capabilities including model versioning, approval workflows, explainability, auditability, and controlled model updates. **How we comply:** See Section 6, Experience Example 7. ### 3.4.4 Open-Source Models & Sovereign Compute Compliance (SOW p.8) **Requirement:** Failure to propose open-source models or components that comply with the Sovereign Compute Environment requirements may result in rejection of a Response. **How we comply:** [PROVIDE: Identify the specific open-source AI/LLM models and components proposed for the EAL Benchmark Assessment Application (e.g., Whisper for speech-to-text, a specific open-source LLM for assessment generation). Confirm each proposed model's licence is compatible with the Province's Sovereign Compute Environment requirements. Confirm no proposed model component requires data to leave Canada or is subject to foreign licensing restrictions that would violate sovereignty requirements. This is a **mandatory requirement** — failure to address it may result in rejection.] --- ## 3.5 Delivery, Milestones & Pilot ### 3.5.1 Firm Delivery Milestones (SOW p.6) **Requirement:** The Due Date(s) specified in Appendix B, Table 9 shall constitute firm delivery milestones. **How we comply:** NimbleStride Inc. acknowledges that all Due Dates in Appendix B, Table 9 are firm milestones. Our project plan (see Section 4) will be structured to meet each milestone. [PROVIDE: Once the SSA is executed, insert the specific milestone dates from Table 9 into the project plan and confirm resource allocation against each.] ### 3.5.2 Mandatory Pre-Production Pilot (SOW p.7) **Requirement:** The Contractor shall conduct a mandatory pre-production pilot with 5–10 participating school authorities using representative student voice recordings before final acceptance. **How we comply:** NimbleStride Inc. will plan and execute a structured pre-production pilot with 5–10 school authorities as a mandatory gate before final acceptance. The pilot will use representative student voice recordings and will include structured feedback collection, defect resolution, and a pilot completion report. [PROVIDE: Detail the pilot plan — recruitment of school authorities, pilot duration, success criteria, feedback mechanisms, and how pilot findings will be incorporated before final acceptance. Confirm whether the Province will identify and coordinate participating school authorities or whether the Contractor is responsible.] ### 3.5.3 Key Documentation Delivery (SOW p.15) **Requirement:** The Contractor shall provide Key Documentation during the Term as specified in AMSA Schedule 2 (Required Outcomes), Section 3.3, and Schedule 3D (Deliverables), Section 3.3. All Key Documentation must be delivered into the Province's designated GitHub repository (or other repository identified in writing by the Province). **How we comply:** NimbleStride Inc. will deliver all Key Documentation to the Province's designated GitHub repository throughout the Term. Documentation will be version-controlled and maintained current. [PROVIDE: List the specific Key Documentation items required under AMSA Schedule 2, Section 3.3 and Schedule 3D, Section 3.3, and map each to a delivery milestone in the project plan.] ### 3.5.4 Key Contractor Personnel — Single Point of Contact (SOW p.17) **Requirement:** For SSAs executed after October 1, 2025, the same individual(s) designated as Key Contractor Personnel will act as the single point of contact and management lead across all SSAs executed under this Contract, unless otherwise approved in writing by the Province. **How we comply:** Mohammed Yousuf Shariff (Principal, NimbleStride Inc.) is designated as Key Contractor Personnel and will serve as the single point of contact and management lead across all SSAs executed under this Contract. Any proposed change to Key Contractor Personnel will be submitted to the Province for written approval in advance. --- ## 3.6 Mandatory Experience Requirements (Appendix B, Section 1) > Each mandatory experience example must include: (a) title and description; (b) requirements and outcomes achieved; (c) start and end dates; (d) name of the organisation; and (e) name and contact information for a confirming reference. See Section 6 for full project examples. ### 3.6.1 MR-1: AI-Enabled Application — Design, Development, Implementation & Support (SOW p.28) **Requirement:** One completed project demonstrating experience designing, developing, implementing, and supporting an AI-enabled application. **How we comply:** See Section 6, Experience Example 1. [PROVIDE: Complete all five required fields per SOW p.30.] ### 3.6.2 MR-2: AI-Enabled Solution Generating Assessments/Classifications/Recommendations Requiring Human Validation (SOW p.28) **Requirement:** One completed project demonstrating experience developing an AI-enabled solution that generates assessments, classifications, recommendations, or decision-support outputs requiring human validation or approval. **How we comply:** See Section 6, Experience Example 2. [PROVIDE: Complete all five required fields.] ### 3.6.3 MR-3: Two or More AI Capabilities (SOW p.28) **Requirement:** One completed project demonstrating experience implementing two or more specified AI capabilities. **How we comply:** See Section 6, Experience Example 3. [PROVIDE: Identify which two or more AI capabilities from the SOW p.28–29 list are demonstrated, and complete all five required fields.] ### 3.6.4 MR-4: Educational Technology / Assessment / Benchmarking / Learning Platform (SOW p.29) **Requirement:** One completed project demonstrating experience developing an educational technology platform, assessment solution, benchmarking application, learning platform, or comparable AI-enabled solution. **How we comply:** See Section 6, Experience Example 4. [PROVIDE: Complete all five required fields. **CRITICAL GAP:** The company dossier does not contain a confirmed EdTech or educational assessment project. If no such project exists, this mandatory requirement cannot be met from dossier facts alone. Assess whether any existing project (e.g., ClearBid, OSFI E-23 platform) can be characterised as a "comparable AI-enabled solution" under the SOW's language, and obtain Province confirmation if needed. Do not claim experience that does not exist.] ### 3.6.5 MR-5: Secure AI Workloads in Canadian Sovereign Computing Environments (SOW p.29) **Requirement:** One completed project demonstrating experience deploying and operating secure AI-enabled workloads within Canadian sovereign computing environments satisfying client privacy, security, and data residency requirements. **How we comply:** See Section 6, Experience Example 5. [PROVIDE: Complete all five required fields. The OSFI E-23 model-risk platform and/or ClearBid are potential candidates — confirm Canadian sovereign deployment details and obtain client reference.] ### 3.6.6 MR-6: Privacy, Security, Audit Logging, Encryption, Access Controls & Secure SDLC (SOW p.30) **Requirement:** One completed project demonstrating experience delivering a solution incorporating privacy, security, audit logging, encryption, access controls, and secure software development practices appropriate for sensitive information. **How we comply:** See Section 6, Experience Example 6. [PROVIDE: Complete all five required fields.] ### 3.6.7 MR-7: AI Governance — Model Versioning, Approval Workflows, Explainability, Auditability, Controlled Model Updates (SOW p.30) **Requirement:** One completed project demonstrating experience implementing AI governance capabilities including model versioning, approval workflows, explainability, auditability, and controlled model updates. **How we comply:** See Section 6, Experience Example 7. [PROVIDE: Complete all five required fields. The OSFI E-23 model-risk-management platform is a potential candidate — confirm governance capabilities implemented and obtain client reference.] ### 3.6.8 Resource Mandatory Experience Levels (SOW p.40) **Requirement:** Each Contractor resource must meet or exceed the mandatory experience level defined in the SOW table for the resource role they are fulfilling. **How we comply:** See Section 5 (Key Personnel). [PROVIDE: Map each proposed resource to the SOW's mandatory experience level table and confirm each resource meets or exceeds the required level.] --- ## 3.7 References (SOW p.20) **Requirement:** The Response may be rejected if the Contractor or any proposed resource receives unsatisfactory references. **How we comply:** References are provided in Section 6. Two professional references attesting to the delivery performance of principal Mohammed Yousuf Shariff are available: 1. Deb Dash, Director – IT Development, Intact Insurance, +1 416-788-4347 2. Sid Venkat, IT Development Consultant, Northbridge Insurance, +1 416-799-3406 [PROVIDE: A third reference, ideally for a NimbleStride Inc. or MGR Infotech company project, to complement these key-personnel references. Also provide project-specific references for each mandatory experience example in Section 6.] --- # 4. Technical Approach > This section provides outline headings. Each subsection must be completed with specific technical content before submission. ## 4.1 Understanding of the Requirement NimbleStride understands the AMSA EAL Benchmark Assessment Application as a web-based tool enabling trained assessors to record student oral language samples, submit them through an AI pipeline that performs speech-to-text transcription and EAL proficiency classification against Alberta's benchmark levels, and present AI-generated draft assessments to human assessors for validation and approval before results are stored and reported to school authority administrators — replacing or augmenting manual scoring to improve consistency, speed, and auditability across Alberta school authorities. ## 4.2 Proposed Solution Architecture Proposed high-level architecture: (1) React/Next.js web front-end for assessors and administrators, accessible to WCAG 2.1 AA; (2) Node.js/Python REST API layer handling authentication, workflow orchestration, and business logic; (3) AI/ML pipeline — OpenAI Whisper (open-source, Apache 2.0) for ASR/transcription, a fine-tuned open-source LLM (e.g., Mistral or LLaMA 3, hosted on-premise or in Canadian cloud) for proficiency scoring and benchmark classification; (4) PostgreSQL on AWS ca-central-1 (or Alberta-region equivalent) for data storage; (5) integration points with GoA identity (ADFS/Azure AD) and reporting systems via secure API. An architecture diagram will be provided in the final submission — please confirm if a draft diagram can be prepared for review before submission. ## 4.3 AI/LLM Model Selection & Sovereign Compute Compliance Proposed open-source models: OpenAI Whisper (large-v3, Apache 2.0 licence) for automatic speech recognition; Mistral 7B or LLaMA 3 8B (Apache 2.0 / Meta Community Licence — confirm sovereign-compute compatibility) for proficiency assessment generation and benchmark classification. Both models will be self-hosted on Canadian/Alberta cloud infrastructure (AWS ca-central-1 or Azure Canada Central GPU instances), with no data leaving Canadian jurisdiction; model weights and inference endpoints remain entirely within the GoA-approved environment, satisfying SOW p.8's open-source and sovereign-compute requirements. ## 4.4 Speech-to-Text & Language Proficiency Assessment Pipeline End-to-end pipeline: (1) assessor uploads or records student audio via the web app; (2) audio is passed to a self-hosted Whisper large-v3 ASR model for transcription, with confidence scores flagging low-quality recordings for re-recording; (3) transcript and acoustic features are passed to the proficiency scoring LLM, which classifies the student against Alberta EAL benchmark levels and generates a structured assessment draft; (4) outputs include benchmark level, supporting evidence excerpts, and a confidence score; (5) samples below a defined accuracy threshold (e.g., <85% ASR confidence) are flagged for mandatory human review. Accent and dialect robustness is addressed through Whisper's multilingual training corpus and, where needed, fine-tuning on representative Alberta EAL student samples. ## 4.5 Human Validation & Approval Workflow AI-generated assessments are presented to the human assessor in a structured review screen showing the draft benchmark classification, supporting transcript excerpts, and the model's confidence score; the assessor can accept, edit, or override any AI output before approving. All approvals, edits, and overrides are captured in a full audit trail (who, what, when, original AI output vs. final human decision), and no assessment is finalised without explicit human approval — ensuring the human remains the accountable decision-maker throughout. ## 4.6 Explainability & Plain-Language Outputs AI outputs are presented in plain-language summaries: each benchmark classification is accompanied by a brief rationale (e.g., 'The student demonstrated Stage 2 oral fluency based on sentence complexity and vocabulary range observed in the recording') drawn directly from transcript evidence, avoiding technical model jargon. Assessors and administrators see only the evidence-based explanation and the specific transcript passages that drove the classification, enabling them to understand, trust, and meaningfully override AI recommendations in line with SOW Section 3.4.1's explainability requirement. ## 4.7 Data Residency & Sovereign Compute Implementation For Protected A/B data, all storage and processing will use AWS Canada Central (ca-central-1) or Azure Canada Central, with AES-256 encryption at rest and TLS 1.2+ in transit, role-based least-privilege access, and full audit logging. For Protected C data requiring in-Alberta residency, NimbleStride proposes use of Azure Canada Central (Calgary/Edmonton nodes) or a GoA-approved Alberta-based data centre — please confirm whether GoA's existing Alberta-region Azure or AWS infrastructure is available for vendor use, as this is required to close the in-Alberta residency gap identified in SOW Section 3.3.1. ## 4.8 Security Architecture & Secure SDLC NimbleStride follows a secure SDLC integrating security at every phase: threat modelling (STRIDE) during design; mandatory peer code review and static analysis (SAST via SonarQube/Semgrep) on every pull request; dynamic analysis (DAST via OWASP ZAP) against staging environments each sprint; automated dependency/SCA scanning (Dependabot/Snyk) with critical CVEs blocked from merge. All data is encrypted at rest (AES-256) and in transit (TLS 1.2+); access is governed by role-based least-privilege (RBAC) with full audit logging. Pre-production penetration testing by a qualified third party is conducted prior to each major release, with findings remediated and evidenced before go-live. ## 4.9 AI Governance Framework All AI/ML models are version-controlled in Git with semantic versioning; no model update is promoted to production without a documented approval workflow (developer → technical lead → client sign-off) referencing a model change record. Explainability is surfaced via human-readable rationale fields and, where applicable, SHAP/LIME attribution scores logged alongside each decision. Every model inference is written to an immutable audit log (timestamp, input hash, model version, output, confidence score) retained per Province retention policy. Controlled rollout uses blue/green or canary deployment so the prior approved version remains available for instant rollback — directly supporting the governance requirements of Sections 3.4.2 and 3.4.3. ## 4.10 Accessibility (WCAG 2.1 AA) All user-facing interfaces will be designed and tested to meet WCAG 2.1 AA, including keyboard navigation, screen-reader compatibility, sufficient colour contrast, and responsive layouts. Accessibility will be validated through automated tooling and manual testing as part of the Definition of Done. ## 4.11 Quality Assurance & Testing Quality is built in, not bolted on: automated unit and integration tests, security testing, accessibility testing, and structured user-acceptance testing with real end users. Each increment must meet an explicit Definition of Done and pass defined quality gates before it is considered complete. Testing for this engagement spans: unit tests (≥80% code coverage target, Jest/Pytest), integration tests covering all API contracts, WCAG 2.1 AA accessibility checks (axe-core automated + manual screen-reader), SAST/DAST each sprint, and end-to-end regression (Playwright/Cypress). UAT is conducted in two rounds with designated school-authority representatives using scripted scenarios drawn from real EAL assessment workflows, with defects triaged and resolved before sign-off. The mandatory pre-production pilot (Section 3.5.2) is a named phase (see project plan, g39) in which a representative cohort of school authorities runs the live application against production data in a sandboxed environment for a minimum of four weeks, with issues logged, resolved, and re-tested before province-wide rollout. ## 4.12 Project Delivery Methodology We deliver using an Agile / SAFe-aligned, iterative approach led by a SAFe Program Consultant (SPC 6), Certified Scrum Master, and PRINCE2 Practitioner with 17+ years of enterprise delivery. Work is broken into short increments with a working demo each cycle, a clear Definition of Done, quality gates, and transparent flow metrics, so the client has honest visibility into progress and risks throughout. The proposed plan follows five phases aligned to Appendix B Table 9 — (1) Discovery & Architecture (Weeks 1–4): requirements validation, data-model design, security/threat-model sign-off; (2) Iterative Build (Weeks 5–20): two-week sprints, working demo each sprint, Definition of Done gate, flow metrics reported bi-weekly to Province; (3) UAT & Accessibility Validation (Weeks 21–24): two UAT rounds with school authorities, WCAG 2.1 AA sign-off; (4) Pre-Production Pilot (Weeks 25–28): named pilot phase per Section 3.5.2, representative school-authority cohort, issue resolution; (5) Production Release & Stabilisation (Week 29+): go-live, hypercare support, knowledge transfer. Team: Mohammed Yousuf Shariff (Principal / Delivery Lead / SPC 6 / CSM), plus associate consultants for front-end, back-end, QA, and UX (named in g43). Communication: bi-weekly sprint reviews with Province stakeholders, monthly steering report, shared Jira/Confluence workspace for full transparency. ## 4.13 Key Documentation & GitHub Repository Key documentation deliverables per AMSA Schedule 2 Section 3.3 and Schedule 3D Section 3.3 include: System Architecture Document, Data Flow and Entity-Relationship Diagrams, API Specification (OpenAPI 3.x), Security & Privacy Impact Assessment, Test Plans and Test Results (unit, integration, UAT, pen-test), Accessibility Conformance Report (WCAG 2.1 AA), Deployment and Configuration Runbook, User Guides (administrator and school-authority roles), and Source Code with inline documentation. All source code is maintained in a Province-accessible GitHub repository using a trunk-based branching strategy (feature branches → pull request → main, with protected main requiring passing CI and peer review). Documentation is authored in Markdown/Confluence, versioned alongside code, and tagged at each release milestone. A final Documentation Package is delivered at project close and at end of Term. ## 4.14 Transition & Knowledge Transfer Knowledge transfer is treated as a continuous activity, not a end-of-project event: the Province has access to the GitHub repository, Jira/Confluence workspace, and CI/CD pipeline throughout the engagement. In the final phase, NimbleStride delivers structured handover sessions (recorded) covering architecture, deployment procedures, operational runbooks, and model governance workflows. A Transition Plan document is produced at least 60 days before end of Term, identifying all artefacts, credentials, and third-party service accounts to be transferred; a 30-day hypercare period follows go-live (and again at end of Term) during which NimbleStride responds to Province or successor-contractor queries to ensure continuity of operations. --- # 5. Key Personnel > **Note:** Named personnel must be assigned to specific roles and must meet or exceed the mandatory experience levels in the SOW p.40 table. ## 5.1 Mohammed Yousuf Shariff — Principal / Delivery Lead / Key Contractor Personnel **Role:** Single point of contact, management lead, and technical delivery lead across all SSAs (per SOW p.17). **Qualifications and experience (from dossier):** - 17+ years across software development, IT operations, and program delivery - Hands-on AI/software product development: designed and built ClearBid (public-sector compliance AI), ClearBind (AI InsurTech), OSFI E-23 model-risk-management platform for Canadian FRFIs, and GridWitness — in TypeScript, Python, Next.js/React, Node.js, and Terraform, with AI/LLM integration - 9+ years leading scaled Agile delivery (SAFe SPC 6, CSM, PRINCE2) as Release Train Engineer / Scrum Master at Northbridge, Intact, CIBC, Servus Credit Union, and AT&T - Earlier presales and solutioning for SapphireIMS (ITOM/ITSM data-centre management product) - B.Tech (Electrical & Electronics Engineering) [PROVIDE: Full résumé/CV for Mohammed Yousuf Shariff in the format required by the SOW. Confirm which mandatory experience level (SOW p.40 table) this role maps to and that the experience level is met or exceeded.] ## 5.2 Additional Proposed Resources [PROVIDE: For each associate consultant or subcontractor proposed for this engagement, provide: - Full name - Proposed role (mapped to SOW p.40 resource role table) - Relevant qualifications and experience - Confirmation that mandatory experience level is met or exceeded - Availability (% of time, start date) - Full résumé/CV Note: The dossier states the delivery model is principal-led with vetted part-time associate consultants engaged per engagement. Named associates must be identified before submission.] --- # 6. Relevant Experience & References > Each example must include all five required fields per SOW pp.30–31. The dossier identifies several NimbleStride products as potential examples but does not contain client names, dates, contract values, or reference contacts for company projects. All fields marked [PROVIDE] are mandatory — incomplete examples will not satisfy the mandatory requirements. --- ## Experience Example 1 — MR-1: AI-Enabled Application (Design, Development, Implementation & Support