bumicerts-monorepo · alpha-auth-bumicert-regression

Alpha auth + Bumicert regression test

Agentic UI/E2E regression pass against alpha.fund.gainforest.app, focused on email login, handle/password login, Bumicert creation, and cleanup.

Date: 2026-05-14 · Target: alpha.fund.gainforest.app · Tool: agent-browser · pass

Headline result

Flows passed

Blocked

Notes

PDS cleanup checks

No blocking regressions found. Email-code login completed using a sandbox inbox; handle/password login completed for test-d0ca85.climateai.org; the authenticated user created and published a temporary Bumicert; then the Bumicert was deleted through the UI and the PDS confirmed the activity collection was empty.

Cleanup note. Publishing required a temporary site boundary. Deleting the Bumicert removed the org.hypercerts.claim.activity record but left the reusable app.certified.location site record, so I cleaned that up from Manage sites as well. Final PDS checks show both collections empty.

Test matrix

Flow	Result	Steps performed	Evidence	Notes
Email-code login	passed	Opened app, launched sign-in modal, submitted sandbox email, inspected received email code via mail.tm, entered code, approved climateai.org OAuth grant, selected Nature Steward.	modal, code screen, OAuth, signed-in result	First attempted 1secmail API, but that service returned 403 from this environment. mail.tm worked. Verification code is redacted from committed artifacts.
Handle/password login	passed	Opened fresh browser session, switched to Handle tab, submitted `test-d0ca85.climateai.org`, entered password on climateai.org, approved OAuth grant, returned authenticated to app.	handle tab, PDS password form, OAuth, authenticated explore	Password is not included in report text or committed diagnostics.
Bumicert creation	passed	Created a temporary title, story, short description, work type, cover image, contributor, and GeoJSON site boundary; review showed all sections valid; published successfully.	valid review, publish step, success, published detail	PDS saw `org.hypercerts.claim.activity/3mlt6lrpfqs2a` with title `QA Regression Bumicert 2026-05-14` before cleanup.
Cleanup/deletion	passed	Deleted the temporary Bumicert through the detail page modal, confirmed no recent Bumicerts, then removed the temporary site boundary from Manage sites.	delete confirmation, delete success, empty recent list, empty sites	Final PDS cleanup check: `org.hypercerts.claim.activity` and `app.certified.location` both returned `{"records":[]}`.

Flow evidence

1. Email-based login

Started signed out from Explore and opened the sign-in modal.
Submitted a sandbox email inbox address and received a 6-digit Bumicerts sign-in code via mail.tm.
Entered the code, approved the climateai.org OAuth consent screen, and returned to the app.
Selected Nature Steward and landed in the organization onboarding flow, confirming the email-created account was authenticated.

03Email login tab is available and starts disabled until an address is entered.

08After submitting the mail.tm address, the app asked for a six-digit code.

09Code verification routed to climateai.org OAuth authorization for the generated account.

11Final email-login state: authenticated and on Nature Steward organization onboarding.

2. Handle/password login

Opened a separate clean browser session and switched from Email to Handle.
Submitted the provided handle test-d0ca85.climateai.org.
Completed the climateai.org password step and OAuth authorization.
Returned to the app with the test profile visible in the header and Manage navigation enabled.

14Handle tab available in the app sign-in modal.

16climateai.org password form loaded for the submitted handle.

18Password accepted; OAuth authorization screen displayed the correct test account.

19Authenticated Explore page with the test account in the header.

3. Bumicert creation and publish

Opened Create a Bumicert and filled Cover Details with a temporary title, cover image, date range, and work type.
Filled Impact Details with a temporary QA story and short description.
Uploaded qa-test-site.geojson as a site boundary, added the test account DID as contributor, selected the site, and accepted permissions.
Reviewed all sections, published, opened the resulting Bumicert detail page, and verified the PDS record existed before cleanup.

42Cover Details completed with the generated test cover image.

24Impact story and short description filled.

39Site Details valid after contributor entry, GeoJSON upload, site selection, and permission checks.

45Review step showed Cover, Impact, and Site Details all valid.

47Publish action completed with “Your Bumicert was published successfully!”.

48Published detail page for QA Regression Bumicert 2026-05-14.

4. Cleanup

Deleted the published Bumicert from its detail page.
Confirmed the create dashboard returned to “No recent Bumicerts yet”.
Opened Manage sites and deleted the temporary site boundary created for the test.
Confirmed via PDS that both the activity and site collections were empty.

49Destructive action required confirmation.

50UI reported the Bumicert was deleted successfully.

54Recent Bumicerts list was empty after deletion.

61Manage sites was empty after deleting the temporary site boundary.

PDS verification

Before deletion: com.atproto.repo.listRecords on org.hypercerts.claim.activity returned one temporary record:

uri: at://did:plc:5ite5nunf4zty5rbkz7r5tc4/org.hypercerts.claim.activity/3mlt6lrpfqs2a
cid: bafyreiajhz4fkkfeektpqsxpag5mwdtv7ivlazebdmjy22nkfv2eixlaaq
title: QA Regression Bumicert 2026-05-14

After deletion: getRecord for that rkey returned RecordNotFound; final cleanup checks returned {"records":[]} for both org.hypercerts.claim.activity and app.certified.location.

Notes / issues observed

Authentication and publish paths passed

Both login methods completed end-to-end and the publish action wrote the expected PDS activity record.

Reusable site records are separate cleanup

Deleting a Bumicert does not delete a site boundary created during the wizard. This may be intended because sites are reusable, but QA cleanup should remove temporary sites from Manage sites after deleting the Bumicert.

Sandbox email service fallback

The first sandbox provider tried from this environment returned 403 on its inbox API. The test continued with mail.tm and passed. This was a test-infrastructure issue, not an app regression.

Artifacts

Primary screenshotsassets/*.png (61 captured; selected screenshots embedded above) Inbox metadataemail-login-message-redacted.json GeoJSON uploadqa-test-site.geojson PDS before cleanuppds-listrecords-redacted.txt PDS after cleanuppds-after-full-cleanup-raw.jsonl Diagnosticsemail-flow-diagnostics.txt · handle-flow-diagnostics.txt