Replit test data

The Fitting Room brief was pasted word for word (2,236 characters, Power mode) and sent at 20:22 UTC on 25 October 2026. The clock stops when the app is live at a public address and 25 of the 30 checks pass.

The Agent worked about 7 minutes, plus short turns of 37, 15 and 24 seconds. It paused 37 seconds in to ask me to connect Stripe, and the test sat idle about 10 minutes (not Replit's time). It asked twice for the owner's Resend key (declined) and asked which email should be the first admin.

The Agent reported its first build done at 21:26 UTC, 64 minutes after the send on the wall clock, with 1.95 dollars of credits used. The first admin had to sign up and verify before the Agent could grant admin: that was a second message. The first version passed 28 of 30 checks on the private preview.

The first version could not be published while it used Stripe. After the Stripe test account was claimed, Replit asked for a live Stripe account and I stopped. On 26 October one more message removed the payment feature (the Agent worked 7 minutes), I deleted the sandbox connection by hand, and the app answered at https://fitting-room-pilates.replit.app/ at 07:35 UTC, 11 hours 13 minutes after the brief. Three messages in all (build, first admin, remove Stripe).

• The idle time waiting for the Stripe connect and for the decision to remove Stripe was my test sitting still, not Replit's. The 30 checks were not run again on the published app: the 28 is from the first version.

The 30 checks were run on the app's private preview, by hand and by script, with a screenshot per check. I also counted anything the brief never asked for.

28 of 30 passed on the first version. The two that failed: C28 and C29, the booking and admin emails, because Replit needs the owner's own Resend account and key and none was given. The app saved the booking and said delivery was pending setup; eight emails sat as pending in the admin screen.

All ten seed facts were correct. One invention: a line saying credits come back if you cancel before class starts, a rule the brief never set.

• Checks ran on the private preview, not a public address.

Sign-up, log-in, log-out and password reset for a member, an instructor and an admin, then two attacks with the wrong session. Requests and responses are saved as transcripts.

Sign-up with a six-digit emailed code, log-in, log-out and password reset by code all worked for every role. Attack 1 was blocked: filters by member B's id or email returned only A's rows, and changing or deleting B's booking gave 'Booking not found' or 403; B's booking was unchanged. Attack 2 was blocked: a member calling the admin routes got 403 'requires an approved studio role' for summary, class delete, class edit and the CSV; all classes were still there.

• Replit's own security scan was not run. The attacks ran against the private preview with copies of my own session.

Six checks: records written, kept after a reload, a republish and a design change; the admin can view, filter, edit and delete in the tool; records export as a file. After publishing I opened Replit's Database tool.

Bookings, orders, classes and form messages were saved, and the admin could see, filter, add, change and delete them in the app; the bookings CSV export worked. After the dark mode change the Agent reported the same classes, bookings and orders before and after.

The Database tool shows two separate databases, Development and Production, each with its tables and row counts and a My Data editor. After I published, Production held the test records: bookings 4, checkouts 4, classes 31, emails 8, inquiries 1, orders 2, users 4 and waitlist 0.

• I did not edit or delete a row in the My Data editor itself: the admin checks ran in the app's own admin screens. The data was read in Production once, after the publish.

A Stripe test checkout, an order and credits, a declined card and the booking and admin emails, run on the first version before Stripe was removed.

Replit set up the Stripe test connection itself. A $95 pass and a $24 single class both completed in test mode; the admin's Orders tab listed both and the credits were right (5 and 1). The declined card 4000 0000 0000 0002 showed 'Your credit card was declined', and made no order and no credits. Checkout showed shekels by default for a visitor in my location, with a US dollar choice.

The emails were not sent. Replit needs the owner's own Resend account and key, and none was given: the app stored them as pending. The Agent asked for the key twice more during change 8.

I then removed the payment feature with one message (the Agent worked 7 minutes). It reported the Passes page, checkout, orders, APIs, Stripe packages and webhooks removed, 5 free credits once for each new member, existing data unchanged and booking, cancel, capacity and waiting list passing its own tests, with one manual step left, which I did. Payments are not part of the published app.

• I declined the Resend connection on purpose, as I would not hand over the owner's key. Webhook confirmation was read from the order and credits appearing, not from the Stripe event log.

The twelve scripted changes, one at a time, each one message. After each change a short script checked the timetable, My bookings, passes, admin and instructor screens.

Ten of the twelve worked in one message (change 10 needed no change because it was already true). Change 7 planted a bug and the next message fixed it. Change 8 stalled: the Agent built the email records but needed a Resend key to send. Change 9 was sent but its result was not recorded, so it is not counted as done.

The twelve used about $2.80 of credits (from $2.12 to $4.92 on the usage page). Where I read the meter, a change cost between $0.08 and $0.58. The short check passed after every change that finished.

A thirteenth message, not one of the twelve, removed Stripe: the Agent worked 7 minutes. Its own browser sign-up test was blocked by human verification, so it said the signed-in screens were not fully verified in a browser. I did not run the checks again.

• Only a short check ran after each change, not all 30 checks again. Change 9 has no recorded result.

Publishing to the vendor address, Lighthouse on a phone three times on the home page. No test domain was connected because I own none for the test; layout counts and a real phone were not run.

Replit would not publish while the app used the Stripe test connection: the Publish button stayed disabled, and claiming the test account led to a request to activate a live Stripe account, where I stopped. After the Stripe feature was removed and the sandbox connection deleted in the Publishing pane, I pressed Publish at 07:28 UTC and the app answered with HTTP 200 at 07:35 UTC, about 7 minutes later, at https://fitting-room-pilates.replit.app/. It is public with no log-in wall.

Lighthouse mobile (version 13.5.0), three runs on the home page: 44, 45 and 45, median 45; largest paint 8.1 to 8.3 seconds, layout shift 0.31, blocking time 0 to 4 ms, about 1.2 MB in 27 requests.

I did not connect a custom domain, because I own none for the test. The Publishing pane has an Add a domain link next to the address.

• Only the home page was measured; layout faults at other widths, a real phone and add to home screen were not.

The export is downloaded, unpacked, searched for every call that needs Replit, and listed. It was not installed and started on another host.

The download at the project's .zip address works on Core, with no extra step: 910 files, 13.1 MB, a pnpm workspace. Replit couplings found by search: the connectors package (the Stripe key comes through Replit), stripe-replit-sync, Replit's Vite plugins, DATABASE_URL (a Postgres database from Replit) and Clerk keys (sign-in is provisioned and proxied by Replit). To run elsewhere you need your own Postgres, your own Clerk keys and a Stripe secret key, and the connectors call must be replaced. I did not read the terms.

• The zip was read, not installed and started against a database of my own.

Prices were read on replit.com/pricing on 26 October 2026. The credit ledger priced the whole test from the usage page.

Building and changing the test app used about $5 of the $20 of credits that come with Core (the usage page read $4.92 spent after the twelfth change). The first working version cost about $1.95 and the twelve changes about $2.80. Remaining credit last read: $14.99, before the Stripe removal. The Core plan receipt was $21.78, which is the $20 plan plus tax.

Publishing keeps using credits, and after the publish Replit offered to turn on auto-reload so the app is not interrupted; the billing page shows Auto-reload off. I did not read the usage page after the publish, so what the removal and the publish cost is unknown. Replit's pricing page also lists a pay-as-you-go option (effort-based pricing) that I did not read.

Stripe and Resend fees were not measured.

• Limit behaviour, the free plan's limits and the hosting cost after publishing were not read.