{ "schemaVersion": 1, "entries": [ { "date": "2026-09-14", "siteVersion": "Transparency preview 1", "title": "Public transparency record added", "previous": "The site used no visitor analytics or public counters and explained its privacy boundary only on the Privacy page.", "current": "The site now publishes one detailed record of current and planned data use. Download counting is designed but stays off until an accepted installer and a tested public counter exist separately from preview data.", "reason": "Let visitors inspect the privacy boundary instead of relying on a slogan.", "affected": [ "Transparency page", "Privacy page", "Home page" ] }, { "date": "2026-09-15", "siteVersion": "DS-0057 source implementation", "title": "Unsigned public Alpha and aggregate download path prepared", "previous": "Only a signed installer could activate the release UI, and download counting existed only as a deferred design.", "current": "An exactly identified unsigned public Alpha may activate only with the full Windows warning and hash verifier. The prepared counter stores bounded release/source aggregates and corrections, never per-download or visitor records. Production resources and publication remain inactive.", "reason": "Implement the creator-approved zero-dollar Alpha distribution decision without weakening artifact, privacy, evidence, or Windows acceptance gates.", "affected": [ "Download pages", "Releases", "Help", "Privacy", "Transparency", "Release manifest", "Download gateway" ] }, { "date": "2026-09-16", "siteVersion": "DS-0058 source implementation", "title": "Production analytics contradiction and contact gating recorded", "previous": "The site reported zero trackers from repository preview evidence and described app Contact as an in-app draft with no public destination.", "current": "The public record now shows the failed production Cloudflare Web Analytics audit separately from the clean repository preview. App Contact opens the fixed public directory, while all email actions stay disabled until real alias delivery and handling rules are verified.", "reason": "Production behavior, not a local preview, must support production privacy claims, and untested email routes must not be exposed.", "affected": [ "Home", "Contact", "Bug Report", "Security", "Privacy", "Transparency", "Help", "Guides" ] }, { "date": "2026-09-17", "siteVersion": "Creator-support activation", "title": "Optional financial support checkout activated", "previous": "The Support page had no approved payment provider or active financial-support action.", "current": "The Support page now offers one creator-approved Stripe Checkout link for Murmur Sphere. It opens only after a deliberate click, sends no referrer, loads no provider resource on page visit, and creates no Murmur Sphere supporter or payment record.", "reason": "Offer a simple optional way to support the independent project without adding payment code, tracking, accounts, or access benefits to Murmur Sphere.", "affected": [ "Home", "Support", "Privacy", "Known issues", "Transparency", "Data practices", "Network actions" ] }, { "date": "2026-09-17", "siteVersion": "DS-0058 Correction 2 source implementation", "title": "Creator-approved website analytics policy recorded", "previous": "The production audit treated any Cloudflare Web Analytics request as a failure and required the service to be disabled before release.", "current": "Cloudflare Web Analytics is intentionally retained for website visits and page performance under one narrow production contract. It remains separate from desktop-app privacy and the aggregate download counter, and corrected live proof is pending until this exact source is deployed and audited.", "reason": "Align the public policy with the creator's approved privacy-conscious website analytics decision while keeping advertising tracking, app analytics, private-content transfer, cookies, browser storage, and all other outside requests blocked.", "affected": [ "Home", "Privacy", "Transparency", "Known issues", "Production audit", "Data practices", "Network actions", "Release gates" ] }, { "date": "2026-09-18", "siteVersion": "R03 launch contact correction", "title": "Single Workspace contact address published", "previous": "Three proposed email aliases were hidden behind delivery-verification gates, leaving Contact, Bug Report, and Security without a usable address.", "current": "The three pages publish support@murmursphere.com as plain text with practical feedback and report guidance. The site has no contact form, clickable email link, automatic draft transfer, or automatic submission.", "reason": "Use the creator's existing Workspace inbox directly and keep visitors in control of composing and sending every message.", "affected": [ "Contact", "Bug Report", "Security", "Privacy", "Known issues", "Transparency", "Data practices" ] }, { "date": "2026-09-18", "siteVersion": "DS-0058 manual analytics correction", "title": "Exact Web Analytics beacon moved into the site template", "previous": "The repository expected Cloudflare's automatic delivery-layer injection, but repeated production checks found no beacon after the dashboard setting was enabled.", "current": "Every repository-built page now includes the exact creator-provided Cloudflare Web Analytics snippet before the closing body tag. Source and production audits allow only that one approved script and continue rejecting every other outside runtime resource, cookie, or browser-storage record.", "reason": "Make the approved analytics configuration observable and reliable for Worker-served pages without weakening the site's privacy boundary.", "affected": [ "All visitor pages", "Privacy", "Transparency", "Production audit", "Data practices", "Release gates" ] }, { "date": "2026-09-18", "siteVersion": "DS-0058 production verification", "title": "Exact production analytics contract passed", "previous": "The manual beacon was deployed, but its exact production request boundary had not yet passed the repository-owned audit.", "current": "The production audit passed all 19 routes for site commit a0098c1d5902a2e382d6bd55a115fc5c9149de93 and Cloudflare deployment 0095108a-765f-4f4e-bd2b-15f486799a86. Each route loaded one approved script and its exact manual report endpoint, with no other outside request, cookie, or browser-storage record.", "reason": "Close the production privacy gate using observed deployment evidence rather than source assumptions.", "affected": [ "Privacy", "Transparency", "Known issues", "Production audit", "Release gates" ] }, { "date": "2026-09-20", "siteVersion": "Embedded creator support", "title": "Stripe support button embedded", "previous": "The Support page linked to a separate Stripe Checkout page and made no Stripe request until a visitor chose the link.", "current": "The Support page loads the creator-approved Stripe buy button for Murmur Sphere. Loading that page contacts Stripe; checkout still begins only after a visitor chooses the embedded button.", "reason": "Let visitors contribute from the Support page with the creator-provided Stripe buy button.", "affected": [ "Support", "Privacy", "Transparency", "Data practices", "Network actions" ] }, { "date": "2026-09-26", "siteVersion": "Estimated unique downloader correction", "title": "Future download increments now suppress recognized repeats", "previous": "Every eligible website or app-update installer request added to the public total, so repeat clicks and automated-looking traffic could make it much larger than the number of people who tried the app.", "current": "The existing total is retained. Future increments require a fresh website-click intent and an unseen secret-protected browser or fallback code. Repeat recognized browsers, direct requests, crawlers, and app-update downloads do not add.", "reason": "Make the public number a closer, clearly qualified estimate of unique downloaders without requiring an account or letting measurement block the installer.", "affected": [ "Download", "Privacy", "Transparency", "Download gateway", "Data practices", "Network actions" ] }, { "date": "2026-09-27", "siteVersion": "Unlisted support comparison", "title": "Unlisted live Stripe API support comparison prepared", "previous": "The Stripe buy button appeared only on the public Support page.", "current": "The unlisted /donationtest page lets visitors choose an amount before a first-party Worker creates a live Stripe Checkout Session and loads secure payment fields within the page. Visiting the page alone does not contact Stripe, and the existing Support button remains unchanged.", "reason": "Compare a custom donation page and live API checkout with the current embedded button while keeping the key on the server.", "affected": [ "Support comparison", "Privacy", "Transparency", "Data practices", "Network actions" ] }, { "date": "2026-09-27", "siteVersion": "Custom support checkout promotion", "title": "On-page Stripe checkout moved to Support", "previous": "The public Support page loaded an embedded Stripe buy button on visit, and the unlisted /donationtest page provided an on-demand custom Checkout Elements flow.", "current": "The public Support page now uses the on-demand custom Checkout Elements flow. Visiting it alone does not contact Stripe. The unlisted old route remains accessible for earlier payment returns.", "reason": "Use the preferred compact creator support design and make Stripe contact follow a deliberate checkout action.", "affected": [ "Support", "Privacy", "Transparency", "Data practices", "Network actions", "Production audit" ] }, { "date": "2026-10-25", "siteVersion": "0.5.6 public release", "title": "Current local-data and installer disclosures aligned", "previous": "An older repository disclosure described saved app information as encrypted and incorrectly said installer verification was disabled. The previous public release remained 0.4.31.", "current": "The official record identifies 0.5.6 and clarifies the existing current v6 local plaintext/integrity boundary, historical encrypted recovery inputs, and local-only installer verification. Publication may use an exact-object, one-hour R2 session without exporting parent credentials. Existing analytics, payment and download-count contracts are unchanged.", "reason": "Publish the accepted release with accurate current evidence and correct outdated descriptions; no app storage migration, additional telemetry or new online service is introduced.", "affected": [ "Release manifest", "Release history", "Privacy record", "Data practices", "Network actions", "Proof registry" ] } ] }