Skip to content

Release 1.1.0 - #42

Merged
jalmena merged 16 commits into
mainfrom
release/1.1.0
Oct 2, 2026
Merged

jalmena merged 16 commits into
mainfrom
release/1.1.0

Conversation

@jalmena

@jalmena jalmena commented Oct 2, 2026

Copy link
Copy Markdown
Owner

Release 1.1.0

Descriptive shape and colour of a mark with every measurement, in the chart, the table, the CSV and the reports; push notifications to the device behind NEVUS_WEB_PUSH, encrypted per device and relayed by the browser vendor's push service; Portuguese, with one registry of the languages and parity tests; a designer's pass over every screen (one primary action, destructive actions apart, occasional tools folded, the photograph first, two panes where there is room), recorded in docs/design/DESIGN_REVIEW.md with before-and-after boards. CI runs once per tree, as one chain that stops at the first failing job.

The changelog is in CHANGELOG.md. Merged locally with a signed-off merge commit once the checks pass; the release workflow publishes ghcr.io/jalmena/nevus:1.1.0, tags the merge commit and creates the GitHub release.

jalmena added 16 commits October 2, 2026 16:36
…h measurement

Each measurement now carries descriptive numbers: from the confirmed outline,
the perimeter, the compactness (1 for a circle) and the ratio of the two
diameters; from the photograph, the colour of the mark and of the skin around
it in CIELAB, their contrast (ΔE) and the spread of the mark's lightness. When
the reference card is in the photo its grey patch, printed to read as #777777,
sets exposure and white balance first, so the values compare between visits;
otherwise they are what the camera saw and say so. Nothing has a threshold or
an interpretation: the numbers describe.

They are stored with the measurement, shown with each measurement of a visit,
plotted and tabulated in the size chart with their own series, exported in the
CSV, printed in the reports in both languages and backfilled for earlier
measurements with `nevus reanalyze --analyzer descriptors`. The model card has
a section for them, with the measured gates and the limits of colour from a
phone camera.

Signed-off-by: Jose David <josedalmena@gmail.com>
Compactness and the colour contrast with the skin appear as series and as
table columns when the measurements carry them, with the note that says what
they describe.

Signed-off-by: Jose David <josedalmena@gmail.com>
With NEVUS_WEB_PUSH on, a person turns notifications on for the device
they hold, under Settings: once a day, after the reminder hour and only
when marks are due, the device shows how many wait for a photo and the
first names. Each message is encrypted on the server for that one device
(RFC 8291) and signed with the server's key pair (VAPID), made on first
use and stored sealed; the browsers' push services relay what they
cannot read. Endpoints are HTTPS only; a device is forgotten after five
failures or when the service reports it gone. A test message checks the
path at once.

The service worker is now a source file of the frontend, built with
Workbox through vite-plugin-pwa (injectManifest): the same caching as
before, plus the push and notification-click handlers. The end-to-end
backends run with the flag on. The deployment guide, the privacy and
security documents and the threat model (addendum for 1.1.0) describe
the channel.

Signed-off-by: Jose David <josedalmena@gmail.com>
The interface, the emails, the calendar feed, the webhooks, the push
greeting and the reports speak Portuguese (European) as well as English
and Spanish. The languages are listed once, in nevus.languages; the API
types, the stored preferences, the reports and the lint read that list,
so adding the next one is the procedure DEVELOPMENT.md now describes.

Two tests keep the catalogues honest: every language has the same keys
and placeholders as English, in the app and in the backend, and the
descriptive-language check runs over the Portuguese texts with its own
word list. The README's status paragraph describes the released state.

Signed-off-by: Jose David <josedalmena@gmail.com>
…he new mark actions

A visit to the clinician is a consulta; what the person records about a
mark is an observação, as Spanish now says vistazo. The Portuguese
catalogue also gains the hint for placing a mark in a selected zone and
the action that moves a mark to the trash.

Signed-off-by: Jose David <josedalmena@gmail.com>
…not fail the first one of each file

Signed-off-by: Jose David <josedalmena@gmail.com>
Pull requests already cover feature, release and hotfix branches, and
main is tested as the release branch it is merged from; on a single
serial runner the same tree was running twice. Pushes now trigger the
workflow on develop only. The backend tests use every core of the
runner instead of two.

Signed-off-by: Jose David <josedalmena@gmail.com>
…st, two panes where there is room

A designer's pass over every screen, recorded in docs/design/DESIGN_REVIEW.md
with before-and-after boards. The person page keeps one primary action
within the thumb's reach: the map leaves room under it, and appointments,
sessions, calendar, reports and profile fold under their titles with a
one-line hint, opening by themselves when something inside is live. From
900 px the map sits on the left, sticky, with the marks and tools on the
right. The mark page shows its visits first and its destructive action
last, apart, behind a hairline; the visit page shows the photographs
first, the first one the width of the page and uncropped, with the
quality note as its caption, and keeps the trash action apart as well.
The session page leads with the next region to photograph and folds the
pose of the others. The settings page opens with the account and a list
of its sections, side by side with them from 900 px. The sign-in pages
carry the wordmark on its dark paper and the tagline.

Pages keep a 48rem column by default and may declare themselves wide;
grid panes shrink (min-width: 0) so a row of pills scrolls instead of
widening the page. The end-to-end flows open a folded tool before using
it, and the accessibility sweep of the gallery stays at zero findings.

Signed-off-by: Jose David <josedalmena@gmail.com>
…lery

Signed-off-by: Jose David <josedalmena@gmail.com>
On a single serial runner the six jobs ran one after another whatever
happened, so a failure in the first minute still cost the hour. They now
form one chain: security, frontend, backend, image, end to end; a job
that fails skips the ones after it. The commit-message check stays apart
because it only runs on pull requests. With more runners the chain can be
widened again, since the three expensive jobs do not depend on each other.

Signed-off-by: Jose David <josedalmena@gmail.com>
Signed-off-by: Jose David <josedalmena@gmail.com>
Signed-off-by: Jose David <josedalmena@gmail.com>
Signed-off-by: Jose David <josedalmena@gmail.com>
Signed-off-by: Jose David <josedalmena@gmail.com>
…secrets

The push tests use the authentication secret and the keys of the RFC's
worked example; the secrets scan took them for an API key. They join the
RFC 6238 vector in the scan's allowlist.

Signed-off-by: Jose David <josedalmena@gmail.com>
Signed-off-by: Jose David <josedalmena@gmail.com>
@jalmena
jalmena merged commit 6556f86 into main Oct 2, 2026
6 checks passed
@jalmena
jalmena deleted the release/1.1.0 branch October 2, 2026 15:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant