Sprint 1 evidence
This index preserves evidence for the Sprint 1 location/exploration release. It does not describe the full current Basic release. Use the testing strategy for repository-wide procedures and the later sprint evidence pages for their dated results.
This index supports #20. A linked procedure is evidence of a method, not evidence that its unrecorded manual steps passed.
| Requirement / claim | Evidence | Source | Status | Manual follow-up |
|---|---|---|---|---|
| Release scope and checklist | Recorded branch validation; testing strategy | #20 | Repository procedure | Link final reviewed evidence and post-merge runs from #20. |
| Deterministic integrated journey | E2E design, apps/web/playwright/sprint1.deterministic.spec.ts, npm run test:e2e:sprint1 | #50, merged PR #136 | Automated/local | Attach two consecutive release-branch results; CI enablement remains a separate prerequisite. |
Protected API returns 401 | apps/api/tests/authentication.integration.test.ts, events.integration.test.ts, cors.integration.test.ts; public GET /api/v1/events smoke | #20, #45 | Automated/local and public smoke | Repeat after merge and record timestamp/SHA. |
| Event discovery and PostGIS eligibility | apps/api/tests/event-database.integration.test.ts; deterministic E2E | #20, #48, #50 | Automated/local | Production DB release evidence remains operator-run. |
| Reachable, unreachable, denied, retry, API failure | apps/web/tests/explore-page.test.tsx; deterministic E2E for reachable, unreachable, denied | #20, #50 | Automated/local | Attach deployed/manual outcomes. |
| Map-independent text fallback | apps/web/tests/exploration.test.tsx; trust boundaries | #20, #44 | Automated/local | Attach deployed browser map-failure evidence. |
| Field calibration | Field evidence and player journey | Closed #43, merged protocol PR #57 | Gitea closed; repository results unrecorded | MANUAL — link/review the actual external #43 evidence, confirm threshold interpretation, and update the repository record if appropriate or record the discrepancy as follow-up work before closing #20. |
| Accessible/mobile journey | Explore semantic tests and responsive implementation; #44 dependency | #44 | Partial automated evidence | MANUAL — attach/link reviewed keyboard, focus, 360/390/768/desktop evidence before closing #20. |
| Auth0, CORS, and location privacy | Auth/API/CORS tests; deployed boundary review; trust boundaries; deployment guide | #45 | Public deployed and automated evidence | Canonical allowed-origin, denied-origin, unauthenticated, invalid-token, custom-issuer, safe-error, authority, and location-storage checks are recorded. A signed-in production browser and Azure log inspection remain operator-run. |
| Repeatable database release | Database release procedure | #47, merged PR #53 | EVIDENCE FROM DEPENDENCY | Operator approval and sanitised production execution evidence are required. |
| PostGIS recovery | Migration recovery checks, event-database.integration.test.ts | #48, merged PR #54 | Automated/local rehearsal design | MANUAL — attach/link reviewed sanitised #48 result from #20. |
| Visual identity and presentation | Campus seal/branding history and current UI | #51, PR #55, PR #83, PR #86, PR #90 | EVIDENCE FROM DEPENDENCY | Link external screenshots/review if they are required release evidence. |
| Public Web/API deployment | Azure guide, .gitea/workflows/ci.yml, public read-only smoke | #17, #20 | Public availability can be checked | Authenticated Web-to-API journey and release-SHA deployment proof remain manual/post-merge. |
| Public documentation | apps/docs, .gitea/workflows/docs-deploy.yml, CI guide, public docs site | #15, PR #91, PR #95 | Public site exists | Verify this new package after its main deployment. |
| CI and deployment | .gitea/workflows/pr-validation.yml, ci.yml, docs-deploy.yml | #17, #20 | Workflow definitions | MANUAL — link successful PR and exact main/release-SHA runs after merge. |
| Four contributors | git shortlog -sne --all and commit history | #20 | Four apparent names, multiple aliases | MANUAL — map aliases to the four humans and review meaningful non-merge commits. |
| Severe-defect gate | Current Gitea issue list | #20 | Not available from repository history | MANUAL — confirm no open P0/P1/severe issue immediately before release closure. |
| Decisions and limitations | Known limitations, Auth0 integration, map architecture, and location documents | #20 and linked dependencies | Repository evidence | Record any release finding as a linked defect/decision. |
| Meetings, ceremonies, and screenshots | Initial client meeting record, Sprint 1 Scrum records, and the five supplied planning/Daily Scrum images | Team-confirmed recollection, repository history, the 17 August scheduling email, and supplied images | Mixed retrospective and contemporaneous evidence | The client meeting, Sprint Review, and Sprint Retrospective records are reconstructed rather than transcripts. Retain contemporaneous notes, dated feedback, and real artefacts for later interactions and ceremonies. |
| AI attribution | Declarations in changed release documents and eventual commit trailer | Course policy and #20 | Repository declaration | Reviewer confirms final declaration matches material tools/models. |
Public deployment locations
Record release-specific results in #20 rather than editing historical claims into this index. Evidence must exclude credentials, complete tokens, connection strings, and unnecessary precise coordinates.
Recorded branch validation — August 2026
The historical release procedure recorded two consecutive
npm run test:e2e:sprint1 runs passing, two tests each. The complete 11-file
database selection passed 106 tests on disposable temporary databases. These
are local results for the location/exploration slice, not the later Basic
release or production database operations. The source does not identify the
exact branch SHA for those local executions.
The Windows formatting baseline was recorded separately: repository-wide
format:check reported 276 unchanged files before the documentation edit and
273 afterwards; changed-file Prettier checks passed. This is a historical
baseline, not a statement about the current checkout.
Public smoke — 18 August 2026
These read-only checks establish public availability at validation time; they are not the required post-merge release-SHA checks.
| URL/path | Result | Safe interpretation |
|---|---|---|
API /health | 200, JSON | API health endpoint responded. |
API /api/v1/ | 200, JSON | Versioned API root responded. |
API /api/v1/events, no bearer token | 401, JSON | Protected event discovery rejected an unauthenticated request. |
Web /, /about, /explore | 200, HTML for each | Public SPA and direct routes were served. |
Documentation / | 200, HTML | Public documentation site was available. |
Documentation /docs/testing/sprint-1-deterministic-e2e | 200, HTML | Existing Sprint 1 E2E documentation was deployed. |
Recorded #20 acceptance outcomes
| # | Criterion | Status | Evidence or remaining gate |
|---|---|---|---|
| 1 | Deployed Web communicates with deployed API | MANUAL REQUIRED | Separate public Web/API availability passed, but a production Auth0 session and sanitised browser network evidence are required. |
| 2 | Authenticated player completes target journey | MANUAL REQUIRED | Follow the deployed player journey below with a safe test player. |
| 3 | Unauthenticated protected API request returns 401 | PASS — deployed/public | Public GET /api/v1/events returned 401; API authentication/event/CORS integration tests also cover it. |
| 4 | Seeded event loads from PostgreSQL/PostGIS | PASS — automated/local | event-database.integration.test.ts and two deterministic E2E runs exercise the disposable PostGIS database. Production seed evidence remains manual. |
| 5 | Reachable and unreachable claims differ visibly | PASS — automated/local | Explore component tests and deterministic E2E assert distinct text and real API/PostGIS outcomes. |
| 6 | Permission denial is usable | PASS — automated/local | Explore component test and deterministic E2E retain event discovery and show an explanation. |
| 7 | Poor/ambiguous accuracy gives safe retry | PASS — automated/local | Explore and API event integration tests assert location_accuracy and stale/future retry states. Gitea #43 is closed, but its repository field-test record has no real-device results; that evidence discrepancy remains a #20 closure gate. |
| 8 | Map has usable text fallback | PASS — automated/local | exploration.test.tsx keeps the event list/actions available on provider failure and timeout. Manual deployed visual evidence remains required. |
| 9 | Public documentation is available | PASS — deployed/public | Root and existing deterministic-E2E route returned 200; this new package requires post-merge deployment verification. |
| 10 | Deterministic E2E passes | PASS — automated/local | Two consecutive npm run test:e2e:sprint1 runs passed, 2 tests each. |
| 11 | Main CI and deployment checks pass | MANUAL REQUIRED | Cannot pass before merge; link exact main validation and triggered deployment runs afterward. |
| 12 | No known severe defect remains open | MANUAL REQUIRED | Confirm current Gitea has no open P0/P1/severe blocker immediately before closure. |
| 13 | Four members have meaningful version-control contributions | MANUAL REQUIRED | Git history shows commits under Kevin, Tyron, Uzair, and Caleb names, with multiple aliases; a team reviewer must confirm identity mapping and meaningful contribution. |
| 14 | Sprint evidence is organised and linked | MANUAL REQUIRED | This package organises repository evidence, but reviewed external screenshots, recordings, meetings, dependency attachments, and final run links still need to be added to #20. |
| 15 | AI use is attributed under course policy | PASS — automated/local | Changed submission-facing release documents name ChatGPT-Web[GPT-5.6 Sol] and Codex[GPT-5]; final commit needs the matching trailer. |
The demonstrated scope was sign-in, event discovery through map or list, and server-authoritative reachable/unreachable/retry results. Challenge, cards, decks, battles, and Author publication were outside that Sprint 1 target. Public route availability did not establish an authenticated deployed journey. Manual acceptance, exact post-merge release/CI evidence, field outcomes, team identity/contribution review, and supporting attachments remained open in this record. Current validation uses the testing strategy.
Authentication and privacy
Recorded review: 22 August 2026, 21:06 SAST; repository baseline 719cd4b.
The deployed SHA was not exposed. Missing and synthetic-invalid tokens returned
safe 401 responses, canonical-origin preflight returned 204, and unapproved
origins received no API allow-origin header. No release-blocking defect was
found within these tested public boundaries.
Signed-in production storage/console checks and Azure log inspection were still operator-run gaps, not passes. The full repository record preserves the checks and privacy limits; this was not a penetration test.
On-campus field evidence
The Sprint 1 protocol was delivered in PR #57, but its six real-device runs have no recorded outcomes. The recorded closed status of #43 does not establish field calibration. Radius, freshness and accuracy thresholds were provisional; no campus pass is claimed.
The repository protocol preserves the unfilled results. Its one-shot browser procedure is historical; use the location journey and eligibility rules for current behaviour.
Known limitations
These limitations apply only to the Sprint 1 location/exploration release validated by #20. They are not a list of later-sprint feature gaps.
| Limitation | Classification and release treatment |
|---|---|
| Browser geolocation is an untrusted claim | A device reading can be inaccurate, stale, manipulated, or unrelated to physical presence. The UI says “reported location”; the API validates the claim and PostGIS remains authoritative, but this is not tamper-proof presence proof. |
| Location thresholds remain provisional | Gitea #43 is closed, but the repository field-test record still contains no recorded real-device campus results. Before #20 closes, link and review the actual external #43 evidence, confirm the seeded 75 m radius, two-minute freshness value, and accuracy-envelope interpretation, then update the repository record if appropriate or record the discrepancy as follow-up work. |
| Poor accuracy can legitimately return retry | Near a boundary, the accuracy envelope may prevent a safe reachable/unreachable result. The player must receive a fresh retry action; repeated retries under field conditions should be recorded as a defect or calibration input, not overridden in the browser. |
| Live map presentation depends on Mapbox | Provider, token, style, tile, WebGL, or network failure can remove the visual map. Event information and reachability actions remain available in the text list and must be checked manually on the deployed build. |
| Auth0, Mapbox, Neon, Azure, and Cloudflare are external services | Their availability and configuration are outside the application process. Local deterministic tests control Auth0/Mapbox while keeping Fastify/PostGIS real; public and authenticated deployment checks are still required per release. |
| Deterministic E2E is not in Gitea Actions | The runner does not yet have an established dedicated disposable TEST_DATABASE_URL and reliable Chromium-capable image. The suite must be run twice locally; it must not be enabled until both safety/reliability prerequisites exist. |
| Location retention remains unresolved | The current Web sends a one-shot claim and does not build location history. The final retention policy remains an open privacy decision, so evidence must not assume permanent exact-coordinate storage is required or approved. |
| Authenticated deployment privacy evidence is operator-run | Public authentication and CORS checks plus automated storage/logging regressions are recorded in the deployed boundary review. A real signed-in production browser and Azure log inspection still require a trusted operator; evidence must never include tokens or precise coordinates. |
| Automated accessibility is incomplete evidence | Semantic tests cover text, alerts/status, action names, and map independence. Keyboard, focus, touch, responsive layout, reduced motion, and screen-reader quality still require reviewed manual evidence. |
| Production database release is operator-controlled | Gitea deployment does not migrate or seed production. The approved release procedure and recovery rehearsal must be executed/reviewed with sanitised evidence; local integration results are not production proof. |
| Current issue state is not encoded in Git | Passing tests cannot prove that no severe defect is open. A current Gitea P0/P1/severe-defect check is a mandatory release gate. |
No severe application defect was established by the repository-side validation document itself. That statement is not a substitute for the current Gitea gate or the outstanding manual evidence above.
AI declaration
This document was planned and reviewed with assistance from ChatGPT-Web[GPT-5.6 Sol] and generated and edited with assistance from Codex[GPT-5] and Codex-CLI[GPT-5.6 Sol]. The historical-status notice was added with assistance from Codex-CLI[GPT-5].
Historical release outcomes consolidated with assistance from Codex[GPT-6], retaining original ChatGPT-Web[GPT-5.6 Sol], Codex[GPT-5], and Codex-CLI[GPT-5] attribution and evidence boundaries.
Public evidence consolidated with assistance from Codex[GPT-6]. Historical results, source revisions, original attributions, and acceptance limits are preserved; no checks were rerun for this consolidation.