Spaces:
Sleeping
Sleeping
Commit History
-
Link BBH name in the intro to the BBH website
1b34235 -
Update README.md
Verified signaturec1ec955
-
Say removal requests are reviewed periodically
'A person reviews every removal request by hand' promised a turnaround the team has not committed to. Periodic review is what actually happens. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>b9b165b -
Stop showing the soft verification warning to students
The name-fragment notice fired on a plain substring match with no word boundary, so any student whose name contains a fragment of the page template ('Hall' and 'Marsh' both sit inside 'Marshall') saw it on every report, and it promised a double-check that nothing recorded. It is now dropped from the UI. The engine's hard verification is untouched: a full identifier surviving still sets VERIFY_FAILED and withholds the file rather than handing over a bad redaction. Only the advisory notice goes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>9d18a5f -
Merge the post-submission text and make the report ID stand out
The 'save this code' warning and the 'how to use it later' caption were two blocks saying one thing, so they are now one warning with both paragraphs. The parenthetical about screenshotting it goes, and the emphasis is trimmed to the opening line. The ID itself rendered as ordinary code output, which was easy to skim past even though it is the one thing a student has to keep. It is now large and bold on USC gold inside a cardinal rule. st.code takes no key, so it is wrapped in a keyed container for the CSS to reach, and wrap_lines keeps all 32 characters on screen at the larger size on a phone. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>063c912 -
Drop the report ID from Step 2
It is shown on the post-submission screen, with a copy button, so repeating it here duplicated the same string a step earlier. Step 2 keeps only its own instruction, which no longer needs markup now that it is a single plain line. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>f3c613a -
Replace the footer byline with a two-line lockup
Cardinal byline over the two schools in small caps, echoing the eyebrow above the wordmark at the top of the page. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>c363213 -
Remove the lost-ID fallback caption from the delete tab
The tab now goes straight from the report ID box to the removal form and the what-happens fold. CONTACT_EMAIL is still used by the upload, submission and verification error paths, so the constant stays. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>7019da2 -
Unbold 'no name attached' in the delete tab
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>32ff36d -
Move the 'no name attached' line into the What you'll need box
Shortened to drop the extra emphasis, and moved up from the caption under the form button into the box about the report ID, where it explains why that ID is the thing being asked for. The caption keeps the fallback for someone who has lost it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>2a06938 -
Drop the access-code clause from the delete tab intro
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>0deead9 -
Bold the 'Worth knowing' lead-in
It matches the bold lead-ins on the Removed and Kept lines above it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>b4fd820 -
Reword the download button so it differs from its fold title
'Download your redacted report' opening onto 'Download my redacted report' read as the same label twice. The button now says what it does to the file. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>f204829 -
Present the download as a fold, matching the preview
The preview sat in a fold while the download was a bare button, so the two things a student can do with the redacted file looked like different kinds of control. Wrap the download in a fold of its own, keyed like the other sub-folds so it keeps body-size styling rather than inheriting the step title. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>ea38cca -
Rename the last step to 'Consent Acknowledgement'
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>65d9919 -
Stop nested folds inheriting the step-title styling
The step-title rules are descendant selectors, so '.st-key-step-fold-1 summary' also matched the summary of the fold nested inside Step 1, and 'How do I even get my STARS report?' rendered at the same weight and size as the step itself. The preview fold inside Step 2 had the same problem. Key both sub-folds and put them back to body size with a rule of equal specificity placed after the title rules, so it wins on order. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>1f73f65 -
Make the step folds read as titles; unbox the report ID line
The three sharing steps were <h4> headings before they became folds, and an expander label renders at body size, so they stopped looking like titles. Give each fold a key and style those three labels alone back to the Newsreader heading treatment, so the sub-folds nested inside them stay visibly subordinate instead of every fold becoming a title. The 'open the PDF' line and the report ID move out of st.caption's grey and st.info's tinted box into plain black body copy, since they are the step's own text rather than an aside. The ID itself is highlighted in USC gold and set in a monospace face so it reads as something to copy. It is secrets.token_hex output, so it is safe to drop into markup. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>0e5ec7d -
Make each sharing step a fold, and lift the report ID to the top of Step 2
Each of the three steps is now an expander, so a student can collapse one they are done with. All three start open, so the flow is unchanged until someone folds something. The 'Sharing Consent Acknowledgement' sub-expander is unwrapped rather than left nested, since the fold it now sits in is named for exactly that. Step 1 keeps its 'how do I get my report' fold, which is genuinely optional detail. 'Open the PDF and make sure it looks right' and the report ID box move from the bottom of Step 2 to directly under its title, so the one string a student needs in order to request deletion is the first thing in the step rather than something below the download button. Verified with Streamlit's AppTest: the script renders locked and unlocked with no exceptions. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>36abe6b -
Drop the success banner and collapse the preview by default
The 'Done!' banner restated the Step 2 heading directly above it. Removing it also means the residual-name notice, when it fires, is no longer the second coloured box in a row. The preview expander now starts closed. A STARS report runs to several pages, so open by default it pushed the download button and the consent step well down the page. The page count stays in the label, so the control still says what is behind it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>12d64c2 -
Move the in-memory handling note into How it works
The note sat under the uploader, where it reached a student who had already picked a file. It answers a question asked while deciding whether to take part, so it belongs in the About tab, as an expander alongside the other two and ahead of them, since it is the first thing that happens to the file. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>9ec2c65 -
Drop the 'only sharing needs a code' sentence from the Questions line
The deletion route it introduced still reads on its own, and the line is shorter without it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>dd6105a -
Fold the access-code explanation into the Questions line
The 'only sharing needs a code' note only appeared inside the Share tab, after someone had already hit the code prompt. Moving it up to the Questions line puts it above the tabs, where a student sees it before picking one, and drops the now-duplicated info box from the locked branch. The 'see How it works' clause goes with it, since the sentence it now joins already points at that tab. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>da7980f -
Drop the two-minutes line and unbox the recap bullets
Removes the 'It takes 2 minutes' paragraph, leaving the intro as the single paragraph that states the ask. The recap bullets lose their bordered container and their TL;DR label and now sit directly on the page: the box framed them as an aside to skip, when they are the four things a student most needs to read. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>87a7901 -
Import pymupdf directly instead of the deprecated fitz alias
PyMuPDF now warns on 'import fitz' and says the alias will be removed. Rename all 20 references across the CLI, the app's preview path and the four redactor modules. The requirement floor moves to 1.24.3, the first release that exposes the top-level pymupdf name. Verified by redacting a real STARS report with the CLI: exits clean with no warning, reports OK (verified clean), and the name, surname and student ID are all absent from the output text. The preview path rasterises all 7 pages. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>f138503 -
Remove the dropzone's cream background entirely
Shrinking the box still left a full-width tinted rectangle around the upload control. Drop its background, border and padding so only the upload button and the chosen file show. The tint came from the theme's secondaryBackgroundColor, which expanders also use, so this is scoped to the dropzone rather than changed in config.toml. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>de84dc6 -
Fix the upload dropzone sizing and declare the real 10MB limit
The previous attempt at shrinking the dropzone matched nothing. Reading Streamlit's own bundle shows why: the dropzone is a <section>, not a <div>, so the div-qualified rule could not apply, and the section-qualified rule used the pre-rename test id stFileUploadDropzone. Match on the test id alone and use !important, since the component's emotion styles are injected at render time. The height came from min-height: 4.25rem on top of 1rem of padding; both are now overridden. Separately, the 'per file' size Streamlit prints in that box comes from server.maxUploadSize, which nothing had set, so it advertised the 200MB default while app.py rejects anything over 10MB. Setting it to 10 makes the printed limit honest and enforces the cap before a byte reaches the app, with the existing MAX_UPLOAD_MB check left as a backstop. This also removes the reason for the CSS that hid that line, which targeted a <small> the component does not render and so did nothing either. Verified by booting the ap…d0c65cb -
Tighten the upload control and drop its duplicate label
The dropzone's default padding left a tall cream slab under the Step 1 heading, which reads as clunky once a file is in it and the instructions are gone. Collapse the padding, shrink the icon, and trim the file row so the box fits its contents. Both spellings of the dropzone test id are matched, since it was renamed between Streamlit versions. Also hide Streamlit's built-in 'Limit 200MB per file' line, which contradicts the 10MB cap this app actually enforces. The widget label repeated the Step 1 heading directly above it, so it is collapsed rather than blanked: an empty label warns and leaves the control unnamed, so the string stays for screen readers. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>8e2efdb -
Replace every em dash across the repo
Rewrites all 105 em dashes in place rather than swapping in hyphens, so the punctuation suits each sentence: colons where the dash introduced a definition or a list, full stops where it joined two independent clauses, commas or semicolons for asides, and parentheses for the one true mid-sentence interruption in the consent copy. One knock-on: the 'didn't produce a file' error now ends a sentence, so the following fragment starts with a capital. Touches app.py (47), CHANGELOG (15), admin/purge_submission.py (10), README (9), DELETION (9), redact_stars.py (6) and redactors/ (9). No behavior changes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>6a889d3 -
Remove emoji from the UI; reword the intro and point to How it works
Strip every emoji from the page: tab labels, buttons, headings and captions, along with the in-text references to the tabs, which had to change in step so "open the Delete my report tab" still names the tab as it now reads. The page_icon argument is dropped rather than emptied, since an empty string is not a valid favicon; the Space's own emoji in the README frontmatter is left alone because it is HF card metadata, not tool UI. Intro now says the reports are used to develop our tool rather than to test against it, and a line under the TL;DR sends anyone with questions to the How it works tab, which needs no access code to read. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>24533df -
Lead with a larger wordmark; drop the title and the optional framing
The page opened with an <h1> asking students to share their report, above a small header lockup. Remove that title and size the BUAI Builder Hub wordmark up to fill the role instead, carrying over the cardinal/gold rule that used to sit under the h1. Also drop the optional/voluntary framing around submission from the TL;DR and the consent acknowledgement. The consent checkbox still gates the upload, so sharing remains opt-in; only the copy changed. Includes work that was already sitting in the tree: an in-page rasterised preview of the redacted PDF (browsers won't render a data: URI PDF in an iframe), and the current deletion form URL. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>1ff5b77
-
Drop the redaction tally and residual warning; surface the report ID at download
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>af9825b
-
Restructure the page into three tabs; open deletion to everyone
The page was one long scroll behind a single passphrase gate, which meant a student who submitted weeks ago had to find an access code just to ASK for their report to be deleted. Deletion is a promise we made them, not a feature to gate. Layout is now three tabs: Share my report access code required, unchanged in strength Delete my report no code - the report ID is the only thing needed How it works no code - what is removed vs kept, and the FAQ Only the upload-and-submit flow is gated. Nothing that was behind the code that could expose a report is now outside it: the uploader, the redaction call and the submit button all still sit behind the same check. What moved out is the explanation and the deletion request, neither of which touches a stored file. Also: - The share flow is now explicitly Step 1 upload / Step 2 check / Step 3 share, so the optional part reads as optional. - The report ID appears in a bordered panel right where the student submitted, instead o…1354970 -
Intro: note that reports are used to test the tool
"...STARS reports that will be anonymized" -> "...STARS reports that will be anonymized to test against our tool!", restoring the purpose of the ask alongside the anonymization claim. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>ff353b6 -
Reword the header and intro, and set the intro slightly larger
- Title: "...Support Our Student Tool!" -> "...Support Our BBH Tool!" - Intro: "BUAI Builder Hub" -> "BUAI Builder Hub (BBH)", so the acronym used in the title and footer is introduced before it is relied on. - Intro: "sourcing STARS reports to test against our tool!" -> "sourcing STARS reports that will be anonymized", with anonymized in bold. - Intro renders at 1.08rem instead of body size. It is the first thing a student reads and carries the ask, so it now looks like it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>b0545a1 -
Replace the shield emblem with the BUAI Builder Hub wordmark
Swaps the SVG shield for the wordmark lockup: a letter-spaced "USC MARSHALL x VITERBI" eyebrow, "BUAI" in near-black, and "Builder Hub" in cardinal. Sized as a header lockup rather than a hero, so it sits above the page title without competing with it. Built as text rather than an image on purpose: it stays crisp at any zoom, needs no asset in the repo, and cannot break the way the explainer screenshots did. Inter 800 is now pulled in for it; only 400 and 600 were being loaded before. Checked by rendering the markup in headless Chrome against the app's own stylesheet, not by eyeballing the code. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>d5e3dbd -
Accept PDFs only, verified by content rather than filename
The uploader's type=["pdf"] filter applies to the FILENAME, so any file renamed to .pdf got through it and was handed to the redaction engine. Uploads are now checked against the "%PDF-" header in the actual bytes. - _upload_rejection() consolidates the filename, size, and content checks into one place, run cheapest-first so an oversized file is refused on its size before anything reads it. - The header is looked for in the first 1 KB rather than at byte 0, since real PDFs sometimes carry junk ahead of the header. Verified a report with leading whitespace still redacts. - Refusals name the actual problem, so a student who renamed a screenshot is told that instead of getting a generic failure. purge_submission.py now states outright that it will only ever target a .pdf path. The report ID pattern already guaranteed it; this makes it a rule rather than a consequence. Tested: ZIP, PNG, Mach-O, HTML, plain text and an empty file all refused when renamed to .pdf; .docx, .exe, r…1fc76f2
-
Fix the explainer section: show the image that exists, drop the 404 link
The "What we keep" section listed explanationSS1/2/3.png, which were never committed, so every student saw three error boxes where the explanation should have been. redaction_explainer.png was already in the repo and unused, and covers the same ground (removed vs kept, letter grades to pass/fail), so the section now shows that. Also: - The same content is now stated in text under the image, including the point that an unusual major/course combination can still be identifying. That disclosure no longer depends on an image loading. - A listed image that isn't present is skipped instead of rendering a raw error at the student. A missing asset is ours to fix, not theirs to read. - Image paths resolve relative to app.py rather than the working directory. - SAMPLE_REPORT_URL pointed at exampleRedactedStars.pdf, which was also never committed, so the "View here" button 404'd. Blanked it, and the section hides itself when it is empty. Upload the sample and put the URL back to res…17bff17 -
Add upload guardrails, deletion purge script, and longer report IDs
Pre-deployment review items: - Upload guardrails: 10 MB size, 15 page, and 30 second processing limits, each with a plain-language message. Size is checked in app.py before the bytes reach the engine; page count and the time limit are enforced in redact_bytes, which takes both as parameters and defaults them to off so the CLI stays unbounded. - Deletion: admin/purge_submission.py deletes a report AND purges it from the dataset's history, since the dataset is version-controlled and a plain delete leaves the file recoverable in the prior commit. DELETION.md explains the rationale and usage. Accepts the legacy 8-character IDs used by every report currently stored. - Report IDs: 8 hex characters from uuid4 -> 32 from secrets, making both guessing and collisions infeasible. Shown in a copy box since it is meant to be copied rather than transcribed. - Residual PII scan (redactors/residual.py): advisory, non-blocking warnings for an email address, phone number, or la…2b5e6b7
-
Add redaction explainer image (via LFS) and .gitignore
d452765 -
Update app.py
Verified signature6b18c21 -
Update app.py
Verified signaturece2e827
-
Redact once and cache: Submit no longer re-scrubs; download and DB upload are the exact same bytes
StrangeIBb7d7774 -
Download filename uses the report UID (not the student's name); same UID shared with the DB submission
StrangeIB16890dc -
Support experience.usc.edu STARS format: detect name via 'STARS Report for', ID via 'ID#:', + per-report link token; old format still works
StrangeIB67c1693 -
Consent: disclose possible de-identified research use
StrangeIB84b9142 -
Trim email to a single 'something went wrong' mention; reword submission-off fallback
StrangeIB9d15c41 -
Deletion: drop unfulfillable lost-ID fallback; stress that the ID must be kept (no name stored)
StrangeIB0c354b0 -
Add CONTACT_EMAIL/DELETE_FORM_URL constants + deletion-request FAQ with form link; document config in README
StrangeIB495a6a5
-
Footer byline always visible (render before passphrase gate too)
StrangeIB443ef7c -
Graceful failure for bad uploads: non-STARS, corrupt/empty, and unexpected errors get clear messages (no tracebacks)
StrangeIB63447d0