Atoms test data

The Fitting Room brief was pasted word for word (1,689 characters) into Atoms' home page in Build mode at 16:21 UTC on 26 October 2026. The clock stops when the app is live and the checks pass: 25 of 30 on the full scale, applied here as 20 of the 24 checks that need no keys of mine.

Alex, the engineer agent, said it would confirm the plan first, then built straight on. It asked for two keys, a Resend key for emails and an optional sender address; I skipped both, because emails are outside this review. The first version appeared about 17 minutes after the brief, and the chat said the build, lint and home-page check passed.

I published at 16:50 UTC and the Atoms address answered about a minute later, 29 minutes after the brief. The app live then is the one that passed 22 of the 24 checks when I ran them, in 1 prompt, with no fix prompt and no hand edits to the app.

The first build used 20.46 credits.

• I ran the 24 checks after the app was live, not at the 29-minute mark, because setting up the logins took longer than the build; the app did not change in between.

The checks were run against the live app, by hand and by short scripts, with a note per check. The six that need your own Stripe and email keys (C24 to C29) are left out, so the thresholds are applied to the 24 that remain: 5 needs 93% or more (23 or more), 4 needs 80% (20), 3 needs 60% (15), 2 needs 33% (8) and 1 is below that.

22 of 24 checks passed, which is 91.7%, just under the 93% a 5 needs. Passing: the three role screens (C04), the timetable with the three seeded classes, days, times and durations (C05), instructors, capacity and places left (C06), booking with a confirm step, My bookings, and cancelling with the place freed and the credit returned (C07 to C09), the full-class rule (C10), the message when there are no credits (C11), another member's bookings staying hidden (C12), the coach seeing only their own classes with the members booked and Attended saved (C13 to C15), the admin adding, editing and deleting classes (C16 to C18), every booking, the CSV and the counts per class (C19 to C21), the Ask the studio form and the admin's list of messages (C22, C23), log-out and log-in again (C02) and all ten seed facts with nothing invented (C30).

Two checks could not be shown: sign-up as a new member with an email and password (C01) and the password reset email (C03). Atoms refused every extra test address, so I had one login. They are counted as not passed, not as failed by the app.

The pages hold only the brief's facts. The marketing lines are the builder's own words, such as 'Small classes. Strong, precise Pilates.', and the single $24 class can be seen but not bought in the app. The studio photo on the home page is a generated image.

• Member B and member C were made by editing booking rows in the data panel, and the 'full class' was filled the same way, so the capacity rule was shown with those rows and one real login.

Log-in, log-out and the role screens on the live app, then two attacks with the app's own requests: asking for another member's bookings, and calling an admin-only action as a member. Atoms refused every test address except the owner's own login, so the member, coach and admin screens were all tried with that one account by switching its role in the data panel.

Both attacks were blocked. The member's bookings request takes no user id: adding a user id of another member changed nothing, and it returned only my own rows. Every admin request, the bookings list, the export, the member list and the delete-class action, answered with an HTTP 403 'You do not have access to this area' for a member.

Sign-in is Atoms' own account page, with Google or an email, and an app user needs an Atoms account. The app's welcome page asks for a name and a role. The first person to choose Admin becomes the admin at once; later coaches and admins wait for approval in the admin's Accounts tab. That is a good rule, but it also means a stranger who opens a brand new app before its owner would become the admin, and Alex told me to sign up as admin first.

Atoms' sign-in page checked the address and then showed no message at all when it refused my plus addresses: the form just stayed where it was. The password reset runs on that same Atoms page, so I could not show it.

• Atoms' own security scan ran before publishing ('Security checked'); a 'Hard-coded credentials found' line was listed in the dialog and I did not open it.

The six data checks: the form and bookings write real records, they survive a reload, a redeploy and a design change, the admin can view, filter, edit and delete them, and they export as a file.

Proved (six): the Ask the studio form and the bookings wrote records; they were still there after reloads and after eight republishes, including the colour change (E03); the admin viewed, edited and deleted rows in the app, and in the data panel searched, filtered, edited cells and deleted rows; and the admin's CSV of bookings downloaded with the right columns.

The data panel shows six tables (bookings, classes, inquiries, orders, profiles and users) and 30 MB used of 10 GB. Atoms' support assistant said the panel exports one table at a time as CSV and that only the workspace owner can export.

Deleting a class in the app also removed its bookings and returned the credits, which the app said in a message. The booking rows of the deleted class were gone from the admin list afterwards.

• I did not run the data panel's own CSV export or its Database Connection String; the CSV I tested is the app's.

The twelve scripted changes, one prompt each, on the live app, which I republished with Update after each. I stop when fewer than 20 credits are left and never buy more. After each change I ran a short check that the three classes, the bookings, the form messages and the timetable data were all still there, not all 24 checks.

Eight of the twelve ran, and all eight worked first time: a phone number field with 'No phone' shown on the admin's Accounts list (E01), Instructor renamed Coach everywhere, with no 'instructor' left in the live app's text (E02), dark green and cream (E03; the first draft already used those colours), an About page with the brief's address, phone and email (E04), Power Reformer's capacity set to 4 (E05), a filter on the timetable by coach (E06), the planted credit bug (E07) and a second email when an admin cancels a booking, with a new Cancel button for admins (E08).

Alex asked before changing the profiles table in E01. In E07 I first asked it to remove the refund of the credit on cancelling, and it did; when I reported that as a bug, it said the refund had not broken, that my earlier message had asked for it to go, and put it back. The E08 email could not be sent without a key, and the admin saw 'The email to the member could not be sent'; the cancel and the credit worked.

Two of my own scripts overlapped and sent the E06 prompt twice and the E03 prompt twice; the repeats changed nothing. The eight used 75.86 credits, from 94.54 to 18.68, and those repeats are in that figure. The dearest change, E06, used 17.62 credits with its repeat.

• The four unrun changes (the phone layout, the admin-only export, the waiting list and the dark mode) could have changed this grade either way; the 24 checks were not re-run in full after each change.

Publish to the Atoms address, timed, then three Lighthouse phone runs on the home page of https://18xyhxh.pub.atoms.world/.

Publish ran a security scan and then went live: the address answered in about a minute. Each Update after a change was about the same. The address is a random name on pub.atoms.world that can be edited. The live app carries a 'Made by Atoms' badge. The pricing page lists 'Remove Atoms badge' under Pro, but the publish dialog marks it Pro+, and the badge stayed on my plan.

The three phone scores were 61, 62 and 66, median 62. The largest contentful paint was 13.2 seconds and first paint about 3.8 seconds, with a layout shift of 0.002. The page weighs 2.1 MB.

Custom domains: 'Connect existing domain' and a link to buy one on IONOS, marked as a beta feature. I did not connect one. A timetable with 100 seeded classes, layout faults at three widths and a real phone were not tested.

• Home page only, no seeded classes, no domain, no layout fault count and no real phone.

The Download Project button in the code panel, then the ZIP unpacked in a new empty folder outside the repo, a read of its files and dependencies, `npm install` with scripts turned off and the front end's build. Nothing from the ZIP was run except that build.

The ZIP is a 2.2 MB full-stack project: a FastAPI (Python) back end with SQLAlchemy and Alembic that reads a standard DATABASE_URL, and a React and Vite front end. The 557 front-end packages installed in a minute and the build finished in about 15 seconds and prerendered two pages.

It is not free of Atoms. The log-in is a standard OpenID flow whose issuer and client ID are settings, so it points at Atoms' sign-in service until you replace it, and the front end calls Atoms' own web SDK (@metagptx/web-sdk). I did not start the back end, because the test machine has no Python.

Atoms' terms of service, read on 26 October 2026 (effective 13 January 2026), section 5.3: 'Atoms makes no claim to ownership of: All content (including code) generated using our Services'; you may freely use it commercially, modify it and distribute it.

• The back end was not started and the 24 checks were not re-run on the export.

The pricing page (monthly and yearly views), the plan page with the credit meter and the cancel dialog were read on 26 October 2026, with a screenshot at each step. Atoms charges in credits, not in dollars per prompt.

The owner bought Pro at the entry tier, 100 credits for $20 a month; the dashboard showed 115 credits, which is the 100 plus 15 free daily credits. The test used 96.32 of the 115: the first build 20.46 and the eight changes 75.86. At the plan's $20 per 100 credits, the first build is about $4.09, if all its credits were plan credits.

Pro also comes at 250 credits for $50 and 350 for $70, and Max starts at $100 for 500. Billed yearly the entry Pro tier is $15.80 a month, 21% less, and other yearly tiers are 18% less. There is no button to buy extra credits: the FAQ says to upgrade to a higher plan, and it shows no automatic top-up, so the plan cannot bill beyond its price.

Unused credits are not kept, apart from a few cases such as an upgrade, bonus credits and invites, and then only for one month. The plan renews itself every month; the dialog on the downgrade says it stays active until 26 November 2026 and that unused credits are then reset. I have not read what 1,000 bookings a month would cost.

• Yearly prices were read, not bought. I did not try the Max plan.