From eeeb542486058bfabc2fa4c083cc0d897ac15dc0 Mon Sep 17 00:00:00 2001 From: Bryan Fawcett Date: Wed, 7 Oct 2026 12:10:28 +0800 Subject: [PATCH 1/4] docs: release review fixes: the licence host per version, one legal date, the changelog cut to 0.1.0 Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01GHjaH1Vt2dVLWU68iz8tFq --- CHANGELOG.md | 32 ++++++++++++++++++-- public/llms.txt | 5 +-- src/data/legal.ts | 5 ++- src/pages/legal/data.astro | 3 +- src/pages/legal/privacy.astro | 4 +-- src/pages/legal/security.astro | 3 +- src/pages/toddle-enhancement-extension.astro | 6 ++-- 7 files changed, 43 insertions(+), 15 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 21bf393..37aeb87 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog -## Unreleased +From this release the site's versions are its git tags, under the org's +versioning policy: each merge into `staging` is a patch tag (v0.0.4 to +v0.0.9 so far), each release to `main` the next minor. The 3.x numbers +below were the site's earlier, hand-kept numbering and are retired; the +`version` in package.json is not the release version. + +## 0.1.0 — 2026-10-07 + +Released with the Toddle Enhancement Extension 0.9.0, which is in Chrome Web +Store review; the site describes it as the next version until it is live. ### Added @@ -18,6 +27,20 @@ ### Changed +- **0.9.0's last changes, on the Releases page and the legal pages.** Text + and icons at the right size on Toddle, a flag's text drawn from its + Markdown, the Excusals tab's Time out column, and a licence key that + follows the teacher's own Chrome account (also kept in Chrome's synced + storage, never sent to Nyuchi). Every page that said the key stays on the + device says so; the wording lives once, in `licenceSync` + (`src/data/legal.ts`). The pricing section shows individual licence holders + the upgrade: code BXXF20VA, US$7 off the organisation licence only. +- **One account of 0.9.0 across the site.** The gradebook's toolbar and the + Attendance dashboard's details run in closed shadow roots in 0.9.0 on every + page; the 6 October review's fixes reach schools in 0.9.0; each version + difference says from which version. +- **A release to `main` is tagged as the next minor** (`main-version.yml`, + the org's reusable auto-tag, with a GitHub release). - **The licence server's address is `licenses.nyuchi.com`.** The privacy policy, the data and security pages, the vulnerability disclosure scope, the extension page's allowlist note, llms.txt and SECURITY.md name the new @@ -63,7 +86,8 @@ Toddle's admin portal. My classes switches on and off at once. - For schools: the Admin console, Group Policy, Intune and macOS steps, the organisation key pasted in once by each teacher, and allowing - `licences.nyuchi.dev`, summarised on the extension page; the full guide + the licence server (now `licenses.nyuchi.com`, and `licences.nyuchi.dev` + for 0.8.2), summarised on the extension page; the full guide on request. A link to the help centre's "How to use" collection. - The data schema (the extension's `docs/data-schema.md`) is described on the data handling page and the extension page, available on request. @@ -82,7 +106,9 @@ PDPA is no longer named. The facts live once, in `dataProtection` (`src/data/legal.ts`). - **The legal pages match the extension's code, for 0.8.2 and 0.8.4**, and - are dated 6 October 2026. Checked against the extension's data schema + were dated 6 October 2026. (Superseded within this release: the pages now + describe 0.9.0, say flags are concealed rather than hidden, and are dated + 7 October 2026; see the entries above.) Checked against the extension's data schema (`docs/toddle-data-fields.md`) and its code: - Student flags: from 0.8.4 they are shown as Toddle shows them, and the free switch hides them everywhere; versions before 0.8.4 hid them by diff --git a/public/llms.txt b/public/llms.txt index 3af4cb3..69b52f1 100644 --- a/public/llms.txt +++ b/public/llms.txt @@ -81,7 +81,8 @@ community-based platforms. Nyuchi Web Services is its development division. processed by Formspree; no student data, no page address, no licence key. (2) Only while a licence is entered, at most once a day, the background worker makes one plain request to https://licenses.nyuchi.com/v1/revocations - (licences.nyuchi.dev, the same server, for earlier versions), + (from version 0.9.0; version 0.8.2, on the store today, asks + licences.nyuchi.dev, the same server), sending no licence key, no identifiers, no cookies and no Toddle data; it downloads a Nyuchi-signed list of SHA-256 fingerprints of cancelled keys and checks its own key locally. Cloudflare sees the IP address as with any @@ -135,7 +136,7 @@ community-based platforms. Nyuchi Web Services is its development division. ## Legal -All dated 6 October 2026. Operated by Nyuchi Web Services, the development +All dated 7 October 2026. Operated by Nyuchi Web Services, the development division of Nyuchi Africa (Private) Limited, Harare, Zimbabwe. - [Privacy policy](https://learning.nyuchi.com/legal/privacy): what the diff --git a/src/data/legal.ts b/src/data/legal.ts index bdf278e..33ec47c 100644 --- a/src/data/legal.ts +++ b/src/data/legal.ts @@ -61,7 +61,7 @@ export const dataProtection = { }, } as const; -/** The date above as people write it: "6 October 2026". */ +/** The date above as people write it: "7 October 2026". */ export const updatedLabel = new Date( `${legal.updated}T00:00:00Z`, ).toLocaleDateString("en-GB", { @@ -246,8 +246,7 @@ export const extensionDataFacts = [ { claim: "Outside connection two, only while a licence is entered: a daily check for cancelled keys.", - detail: - "At most once a day, and only while a licence key is entered, the extension's background worker makes one plain request to https://licenses.nyuchi.com/v1/revocations (earlier versions ask licences.nyuchi.dev, the same server); a key just entered is checked within 5 minutes. It sends no licence key, no identifiers, no cookies and no Toddle data. It downloads a list, signed by Nyuchi, of the fingerprints (SHA-256 hashes) of cancelled keys, checks its own key against that list on your machine, and keeps only the result. Cloudflare, which runs the server, sees your IP address as with any web request; Nyuchi does not log it. If the list cannot be fetched, the last result stands, so a network outage never switches a licence off.", + detail: `At most once a day, and only while a licence key is entered, the extension's background worker makes one plain request to https://licenses.nyuchi.com/v1/revocations (from version ${next}; version ${current}, on the Chrome Web Store today, asks licences.nyuchi.dev, the same server); a key just entered is checked within 5 minutes. It sends no licence key, no identifiers, no cookies and no Toddle data. It downloads a list, signed by Nyuchi, of the fingerprints (SHA-256 hashes) of cancelled keys, checks its own key against that list on your machine, and keeps only the result. Cloudflare, which runs the server, sees your IP address as with any web request; Nyuchi does not log it. If the list cannot be fetched, the last result stands, so a network outage never switches a licence off.`, }, { claim: "Exports are local.", diff --git a/src/pages/legal/data.astro b/src/pages/legal/data.astro index 8c78b7f..238f7db 100644 --- a/src/pages/legal/data.astro +++ b/src/pages/legal/data.astro @@ -247,7 +247,8 @@ const subprocessors = [
  • A daily check for cancelled keys, only while a licence is entered: one plain request from the extension's background worker to - https://licenses.nyuchi.com/v1/revocations (earlier versions ask + https://licenses.nyuchi.com/v1/revocations (from version + {extensionVersions.next}; version {extensionVersions.current}, on the store today, asks licences.nyuchi.dev, the same server), sending no licence key, no identifiers, no cookies and no Toddle data. It downloads a list, signed by Nyuchi, of the SHA-256 fingerprints of cancelled keys and checks its own key locally. Cloudflare diff --git a/src/pages/legal/privacy.astro b/src/pages/legal/privacy.astro index a3a1b1c..1dea3a0 100644 --- a/src/pages/legal/privacy.astro +++ b/src/pages/legal/privacy.astro @@ -142,8 +142,8 @@ const description =
  • What is sent. One plain request to https://licenses.nyuchi.com/v1/revocations, from the extension's - background worker (earlier versions ask licences.nyuchi.dev, the - same server). It carries no licence key, no identifiers, no cookies and no + background worker (from version {security.next}; version {security.version}, on the + store today, asks licences.nyuchi.dev, the same server). It carries no licence key, no identifiers, no cookies and no Toddle data.
  • diff --git a/src/pages/legal/security.astro b/src/pages/legal/security.astro index e0f8a56..be6352d 100644 --- a/src/pages/legal/security.astro +++ b/src/pages/legal/security.astro @@ -314,7 +314,8 @@ const severityClass: Record = {
  • A daily check for cancelled keys. At most once a day, only while a licence is entered, the background worker makes one plain request - to https://licenses.nyuchi.com/v1/revocations (earlier versions ask + to https://licenses.nyuchi.com/v1/revocations (from version + {extensionVersions.next}; version {extensionVersions.current}, on the store today, asks licences.nyuchi.dev, the same server). It sends no licence key, no identifiers, no cookies and no Toddle data. It downloads a list, signed by Nyuchi, of the fingerprints (SHA-256 hashes) of cancelled keys, and diff --git a/src/pages/toddle-enhancement-extension.astro b/src/pages/toddle-enhancement-extension.astro index 87ddcce..a6f603e 100644 --- a/src/pages/toddle-enhancement-extension.astro +++ b/src/pages/toddle-enhancement-extension.astro @@ -199,7 +199,7 @@ const facts = [ { label: "Its two outside connections", value: - "The Send feedback form, only when you press Send: what you typed and the version number, to our feedback form, processed by Formspree. And, only while a licence is entered, at most one request a day to licenses.nyuchi.com for a signed list of cancelled keys' fingerprints, which sends no key, no identifiers and no Toddle data; if it fails, the last result stands.", + `The Send feedback form, only when you press Send: what you typed and the version number, to our feedback form, processed by Formspree. And, only while a licence is entered, at most one request a day to licenses.nyuchi.com (licences.nyuchi.dev, the same server, in version ${extensionVersions.current}, on the store today) for a signed list of cancelled keys' fingerprints, which sends no key, no identifiers and no Toddle data; if it fails, the last result stands.`, }, { label: "What it stores", @@ -513,8 +513,8 @@ const schema = [ it to staff; each teacher pastes it in once, from the welcome page or the toolbar menu's Enter a licence key. If your network filters outbound traffic, allow {toddleExtension.licenceHost} - (and licences.nyuchi.dev, which earlier versions - ask) so the daily check for cancelled keys can run. If it is blocked, licences keep + (and licences.nyuchi.dev, which version + {extensionVersions.current}, on the store today, asks) so the daily check for cancelled keys can run. If it is blocked, licences keep working on the last result.

    From 8902a4f89cd9ec8c6f1d35555e84b8a5b82c8465 Mon Sep 17 00:00:00 2001 From: Bryan Fawcett Date: Wed, 7 Oct 2026 12:10:41 +0800 Subject: [PATCH 2/4] docs: the README's version is the latest tag Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01GHjaH1Vt2dVLWU68iz8tFq --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 5251753..7b69a4c 100644 --- a/README.md +++ b/README.md @@ -9,7 +9,7 @@ ![Astro](https://img.shields.io/badge/Astro-7-BC52EE?style=flat-square&logo=astro&logoColor=white) ![Vercel](https://img.shields.io/badge/Vercel-deployed-000000?style=flat-square&logo=vercel&logoColor=white) -**Version:** 3.0.0 | **Live:** [learning.nyuchi.com](https://learning.nyuchi.com) | **Default branch:** `main` | **Deploy:** Vercel +**Version:** the latest git tag (see [CHANGELOG.md](CHANGELOG.md)) | **Live:** [learning.nyuchi.com](https://learning.nyuchi.com) | **Default branch:** `main` | **Deploy:** Vercel --- From 3e5a003447101a2fc2be447c3bdd591e3e606397 Mon Sep 17 00:00:00 2001 From: Bryan Fawcett Date: Wed, 7 Oct 2026 12:12:14 +0800 Subject: [PATCH 3/4] docs: the changelog's licence-host entry names the versions Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01GHjaH1Vt2dVLWU68iz8tFq --- CHANGELOG.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 37aeb87..692ad00 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,8 +2,8 @@ From this release the site's versions are its git tags, under the org's versioning policy: each merge into `staging` is a patch tag (v0.0.4 to -v0.0.9 so far), each release to `main` the next minor. The 3.x numbers -below were the site's earlier, hand-kept numbering and are retired; the +v0.0.9 so far), each release to `main` the next minor. The 3.x and 2.x +numbers below were the site's earlier, hand-kept numbering and are retired; the `version` in package.json is not the release version. ## 0.1.0 — 2026-10-07 @@ -44,9 +44,9 @@ Store review; the site describes it as the next version until it is live. - **The licence server's address is `licenses.nyuchi.com`.** The privacy policy, the data and security pages, the vulnerability disclosure scope, the extension page's allowlist note, llms.txt and SECURITY.md name the new - host for the daily check for cancelled keys, and say that earlier versions - of the extension ask `licences.nyuchi.dev`, the same server, which still - answers. The legal pages' date moves to 7 October 2026. + host for the daily check for cancelled keys from version 0.9.0, and say + that 0.8.2, on the store today, asks `licences.nyuchi.dev`, the same + server, which still answers. The legal pages' date moves to 7 October 2026. - **@bundu/ui 0.5.0** (was 0.1.1): the kit's updated tokens. The page background is a cooler, neutral off-white; layout, type, buttons and the Nyuchi brand colours are unchanged. Every check and test passes as before. From f79294309d2d8dac5344b631e01ef713cdc979b7 Mon Sep 17 00:00:00 2001 From: Bryan Fawcett Date: Wed, 7 Oct 2026 12:13:27 +0800 Subject: [PATCH 4/4] docs: the staging patch tags start at v0.0.1 Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01GHjaH1Vt2dVLWU68iz8tFq --- CHANGELOG.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 692ad00..ffd59a6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,8 +1,8 @@ # Changelog From this release the site's versions are its git tags, under the org's -versioning policy: each merge into `staging` is a patch tag (v0.0.4 to -v0.0.9 so far), each release to `main` the next minor. The 3.x and 2.x +versioning policy: each merge into `staging` is a patch tag (from +v0.0.1, 2026-10-04), each release to `main` the next minor. The 3.x and 2.x numbers below were the site's earlier, hand-kept numbering and are retired; the `version` in package.json is not the release version.