MADE BY WHOM? — Z.COM UPLOAD GUIDE ================================ WHAT YOU HAVE A self-contained PHP website with six workshop rounds, student phone voting, confidence ratings, host-controlled reveals, response charts, shared leaderboard, CSV results download, a printable facilitator guide and a provenance record. No database, paid service, AI API key, Node.js build or student account is needed. All quiz images, scripts and styles are included. Players and host need internet access to the same deployed website. External source links are optional reading. REQUIREMENTS - PHP 8.1 or newer (use a supported version provided by your hosting plan). - Standard PHP JSON, file I/O, random_bytes and flock support. - A writable parent folder for the website's protected room-data directory. - HTTPS enabled for the subdomain. - Up to 100 players per room is an application limit, NOT a capacity benchmark. For large classes, test your hosting plan or use one phone per small team. Each active browser polls every 2.5 seconds while its tab is visible. UPLOAD TO Z.COM / CPANEL 1. Sign in to Z.com and open your hosting cPanel. 2. Open Domains > Create a New Domain (older cPanel: Subdomains). 3. Enter your chosen subdomain, e.g. ai.yourdomain.com. This is an example only. 4. UNCHECK "Share document root". Give the activity its own document-root folder. Do not overwrite your main website. Copy the document-root location shown. 5. In File Manager, open THAT subdomain's document-root folder. 6. Upload ai-or-human-upload.zip and extract it there. The files index.html, api.php, app.js, styles.css, questions.php and the assets folder must sit directly in the document root, not in another nested ai-or-human folder. 7. Remove the uploaded ZIP from the web folder after extraction. 8. In MultiPHP Manager / Select PHP Version, select PHP 8.1+ for this subdomain. 9. Enable SSL/AutoSSL for the subdomain, then visit its https:// address. 10. Create a test room, join from a second device, vote, reveal and check points. Create a fresh room for the real workshop. Z.com's subdomain guide: https://web.z.com/us/support/web-hosting/add-a-subdomain/ Your regional dashboard labels may differ. Follow the document root actually shown in your own cPanel account. If your DNS is managed elsewhere, configure the subdomain to point to the hosting server as instructed by Z.com. RUN THE WORKSHOP - On the projector: choose Host a game > Create a room. - Students: open the website, choose Join a game and enter the six-digit code, or use the join link on the projector. Use nicknames or team names. - Start after students join. Joining is closed after the first round starts. - Students select an origin AND confidence, then Lock in my answer. - Each answer is final after submission. Timer expiry closes voting. - The host chooses Close voting & reveal, then Next round. - Students cannot advance the host's game. Answers are withheld from live state responses until revealed. Source documents remain publicly readable: this is an educational game, not a secure examination. - After six rounds: debrief and optionally download the summary CSV. - Leave the host tab open. Session credentials are stored in that browser tab's sessionStorage so reloads reconnect. Do not share a browser profile with students or clear its storage during the activity. - Lost host tab/credential? Create a new room; there is no password recovery. - Rejoining requires the original tab session. Leaving clears that session. A fresh tab may use a different nickname while the lobby is still open. - Host and player tests on ONE computer: use separate browser profiles/private windows. Duplicating a host tab may copy its host session. FOLDER PERMISSIONS & STORAGE The application creates ai-workshop-data- next to the website folder, with 0700 permissions. It contains room records, token hashes, nicknames, votes and a creation-rate limiter. PHP files start with an exit guard. A deny-all .htaccess is also added. Do not change the storage files to public JSON files. If the parent folder is not writable or PHP open_basedir blocks it, ask hosting support to create a writable folder OUTSIDE public web roots and set PHP's AI_WORKSHOP_DATA_DIR environment variable to that absolute folder path. If the panel cannot set environment variables, edit the $dir assignment in api.php to use that absolute private directory. Use permissions 0700/0750 as appropriate for your host; do not use 0777 as a blanket fix. Keep PHP enabled: this package must not be served by static-only hosting. PRIVACY & RETENTION No analytics, ads, external fonts or third-party scripts are included. Host sign-in uses an authentication cookie; students do not need it. The application stores nicknames, answers and confidence values, not student accounts or emails. Hosting access logs may contain IP addresses. A SHA-256 hash of the request IP is used to limit new-room creation (20/hour/network). Rooms reject access 24 hours after creation. Expired room files are physically removed when another room is created. For immediate deletion after class, delete that room's room-123456.php file from the protected data directory. For automatic deletion even when no new room is created, ask your host to schedule cleanup of room-*.php files older than 24 hours. The limit file keeps only the last hour's hashed-IP timestamps when a room is created. Download results only if useful, and handle them under your institution's rules. TROUBLESHOOTING - PHP is not running / cannot parse response: do not open index.html as a local file. Use the deployed HTTPS address on PHP hosting. - Room storage unavailable: check private data-directory permissions and PHP restrictions; see FOLDER PERMISSIONS above. - Room not found: check the exact six digits and that all devices use the same website/subdomain. Codes expire after 24 hours. - Connection interrupted: keep the tab open and reconnect. A vote is saved only when the page confirms it. The server clock decides when voting closes. - No automatic reveal: this is deliberate. The host controls reveal timing. - Wrong webpage after upload: confirm the subdomain's document root and whether a pre-existing index.php is taking priority. Preserve your existing files; use a dedicated empty folder rather than deleting another site. - An Apache .htaccess error: ask hosting support about the included directives. The root .htaccess is optional for functionality; keep private storage private. CUSTOMIZE - questions.php contains the six samples, origin keys and discussion prompts. - app.js and styles.css control the interface and behavior. - Replace images only if you can document their origin. Update provenance.html and facilitator.html whenever the sample content changes. - Do not change question order while a room is active. Start a new room after editing the question bank. NOT YET UPLOADED This is an upload-ready package. It has not been deployed to your Z.com account. Use the instructions above or provide the target subdomain and an authorized hosting workflow when ready. Do not paste hosting passwords into chat. PRIVATE HOST ACCESS Only you should know the host password. Retrieve it from the separate private-host-access.txt file supplied alongside the ZIP. Do NOT upload that private text file. After uploading, click Host a game and enter the password. The server requires your host sign-in for room creation and all host controls. Students join using the room code; they do not need the password. A host sign-in cookie is HttpOnly and SameSite=Strict (Secure over HTTPS). Sign-in expires after eight hours. Use Sign out on shared computers. The password hash is in host-config.php, which must be executed by PHP and never served as plain text. Keep PHP enabled and use HTTPS. To change the password, replace the password_hash value with a PHP password_hash() result for your new password. Never put a plain-text password in that file.