Review: Add NVIDIA mirror + task verifiers (site by @KaKituken, verifiers by reviewer) (#58)

.assets-revision

@@ -4,5 +4,43 @@
 # fetch_assets.sh uses the `hf download` CLI. The pin below
 # is a git revision (branch name like `main`, a tag, or a specific commit
 # sha). Override at runtime with the ASSETS_REVISION env var.
+#
+# The revision is a commit sha, never a moving branch name.
+#
+# Current pin = the commit that HF dataset `main` points at (verified
+# 2026-09-13): the squash-merge commit of HF dataset PR #85 ("Upload nvidia.tar.gz
+# with distinct official product and hero images (#107 follow-up)"), which sits on
+# top of the merged PR #84 ("Upload repacked nvidia.tar.gz with de-duplicated
+# official product images (#107)"), PR #75 ("Add reviewed NVIDIA asset bundle") and
+# PR #74 ("Upload kaggle.tar.gz with huggingface_hub"), so this sha is on HF `main`.
+#
+# Its nvidia.tar.gz is the repacked bundle (sha256
+# 617a3e3740ba6706bcab786c8a5c3f9a22ecbb39eff5728ad2c12e4992cb098b, 16340955 bytes,
+# 37 file members and no directory entries), which carries the official NVIDIA
+# renders for 33 product/news images plus three dedicated hero images under
+# static/images/heroes/: 36 images with 36 distinct sha256, so
+# sites/nvidia/static/images/ has no byte-identical duplicate and no page reuses
+# one file twice. It supersedes the 9927312-byte PR #84 archive (sha256
+# ee8c6ba966e7a8f7fb5ad2d7ff0134ab98e7b80d6cc77f3328217405b8b34e2f) and the
+# original 6706395-byte bundle (blob 0f1d8068af602748d0dec19ef04b52c7559fef28),
+# which carried duplicates.
+#
+# Why this sha and not the other candidate (refs/pr/37, resolved
+# 600a3e1de158ae56dc82a5fab56c2ca25acb1e27):
+#   * this revision carries an archive for every registered site (29 of 29), and
+#     the kaggle seed DB it ships was found identical to the seed the site's own
+#     code generates (13/13 tables, row by row) in the PR #106 audit;
+#   * refs/pr/37 ships an older kaggle seed (models table has 10 rows instead of
+#     11: densenet121-chestxray is absent) and its archives cover only 17 of the
+#     29 registered sites, so pinning there would break fetch_assets.sh.
+#   * this revision's kaggle.tar.gz (sha256
+#     dd6f1ab34f99989b300e3366225a8f8b0932d49d033b48f141938d16f1c0607d,
+#     11278106 bytes) passes the repository's own
+#     scripts/validate_asset_archive.py:
+#         [fetch] validated 73 managed members for kaggle
+#     That 73-member pack has no directory entries, so the earlier
+#     `ValueError: unexpected managed path: 'kaggle/static'` rejection (from the
+#     superseded 11278264-byte pack, sha256 c533c283...) no longer applies and
+#     `scripts/fetch_assets.sh` installs sites/kaggle's assets from this pin.
 repo: ChilleD/WebHarbor
-revision: 65c479f894763f64c6073e0d180ebf542d1d2c02
+revision: b7e605c0ec5fc47de85b09e7427162cc50e38980

.claude/skills/clone-website/SKILL.md

@@ -204,7 +204,7 @@ Then run the site once locally to produce `instance/<site>.db`, copy it to
 ```bash
 ./scripts/build.sh webharbor:dev
 docker run -d --rm --name wh-test \
-  -p 8201:8101 -p 41000-41014:40000-40014 webharbor:dev
+  -p 8201:8101 -p 41000-41028:40000-40028 webharbor:dev
 
 # your new site is on port 41000 + its index
 curl -so /dev/null -w "%{http_code}\n" http://localhost:41000NN/
@@ -228,7 +228,7 @@ After Phase 1, you should have:
 - `sites/<your_site>/static/` with real CSS/JS/icons (and images under HF assets)
 - `sites/<your_site>/instance_seed/<site>.db` with seeded data
 - Site registered in `websyn_start.sh`, `control_server.py`, `Dockerfile`
-- All 15 sites still return 200 on the alt-port container
+- All 29 sites still return 200 on the alt-port container
 - Byte-identical reset passes
 
 ## Next step

.claude/skills/evolve-env/SKILL.md

@@ -65,15 +65,15 @@ through `BASE_DIR = os.path.dirname(os.path.abspath(__file__))`.
 After any DB-affecting change:
 
 ```bash
-# 1. Stop test container (don't touch user's working container on :40000-40014)
+# 1. Stop test container (don't touch user's working container on :40000-40028)
 docker stop wh-test 2>/dev/null || true
 
 # 2. Rebuild
 ./scripts/build.sh webharbor:dev
 
 # 3. Run on alt ports
 docker run -d --rm --name wh-test \
-  -p 8201:8101 -p 41000-41014:40000-40014 webharbor:dev
+  -p 8201:8101 -p 41000-41028:40000-40028 webharbor:dev
 
 # 4. Reset your site and confirm byte-identity
 curl -X POST http://localhost:8201/reset/<your_site>
@@ -149,7 +149,7 @@ After Phase 3:
 - Every task in `tasks.jsonl` is hand-verified to work end-to-end
 - The mirror has no obvious leaks, broken forms, or empty pages
 - Byte-identical reset passes
-- All 15 sites still return 200
+- All 29 sites still return 200
 
 ## Next step
 

.claude/skills/harden-env/SKILL.md

@@ -130,7 +130,7 @@ Hardening changes seed data. After any DB change:
 ```bash
 ./scripts/build.sh webharbor:dev
 docker run -d --rm --name wh-test \
-  -p 8201:8101 -p 41000-41014:40000-40014 webharbor:dev
+  -p 8201:8101 -p 41000-41028:40000-40028 webharbor:dev
 curl -X POST http://localhost:8201/reset/<your_site>
 docker exec wh-test md5sum \
   /opt/WebSyn/<your_site>/instance/<your_site>.db \

.claude/skills/review-env/SKILL.md

@@ -33,18 +33,18 @@ gh pr checkout <pr-number>
 ./scripts/fetch_assets.sh             # pull the pinned HF revision
 ./scripts/build.sh webharbor:dev
 docker run -d --rm --name wh-review \
-  -p 8201:8101 -p 41000-41016:40000-40016 webharbor:dev
+  -p 8201:8101 -p 41000-41028:40000-40028 webharbor:dev
 ```
 
-Confirm the new/changed site is on the expected port (40000 + index). Note: the image now runs 17 sites (40000-40016).
+Confirm the new/changed site is on the expected port (40000 + index). Note: the image now runs 29 sites (40000-40028).
 
 ### Step 2: The mechanical checks (5 minutes)
 
 Run the same Pre-PR checks the contributor was supposed to run.
 
 ```bash
-# 1. all 17 sites return 200
-for p in $(seq 41000 41016); do
+# 1. all 29 sites return 200
+for p in $(seq 41000 41028); do
   curl -so /dev/null -w "$p:%{http_code}\n" http://localhost:$p/
 done
 
@@ -231,7 +231,7 @@ Leave a structured comment on the PR:
 ## Review: <site_name>
 
 ### Mechanical checks: PASS / FAIL
-- [x] All 17 sites return 200
+- [x] All 29 sites return 200
 - [x] Control plane healthy
 - [x] Byte-identical reset (md5 match)
 - [x] Parallel reset <10s

.claude/skills/seed-database/SKILL.md

@@ -169,10 +169,10 @@ gh pr create
 ./scripts/check_assets.sh                       # every site has instance_seed/
 ./scripts/build.sh webharbor:dev                # docker build succeeds
 docker run -d --rm --name wh-test \
-  -p 8201:8101 -p 41000-41014:40000-40014 webharbor:dev
+  -p 8201:8101 -p 41000-41028:40000-40028 webharbor:dev
 
-# all 15 sites return 200
-for p in $(seq 41000 41014); do
+# all 29 sites return 200
+for p in $(seq 41000 41028); do
   curl -so /dev/null -w "$p:%{http_code}\n" http://localhost:$p/
 done
 
@@ -182,7 +182,9 @@ time curl -X POST http://localhost:8201/reset-all
 # byte-identity for every site
 for s in allrecipes amazon apple arxiv bbc_news booking github \
          google_flights google_map google_search huggingface \
-         wolfram_alpha cambridge_dictionary coursera espn; do
+         wolfram_alpha cambridge_dictionary coursera espn \
+         merriam_webster ikea phys_org target ted osu rotten_tomatoes \
+         compass walmart_careers fedex; do
   docker exec wh-test md5sum \
     /opt/WebSyn/$s/instance/$s.db \
     /opt/WebSyn/$s/instance_seed/$s.db

AGENTS.md

@@ -4,7 +4,7 @@ A coding agent (Claude Code, Cursor, Aider, Codex, ...) is reading this. Read on
 
 ## What it is
 
-23 Flask mirror websites (Amazon, GitHub, BBC News, ...) packaged into one Docker image, plus a control plane on `:8101` for resetting per-site state. Used as a deterministic offline environment for web-agent benchmarks. ~3 GB image.
+29 Flask mirror websites (Amazon, GitHub, BBC News, ...) packaged into one Docker image, plus a control plane on `:8101` for resetting per-site state. Used as a deterministic offline environment for web-agent benchmarks. ~3 GB image.
 
 Two repos:
 - **code** (this one) — Flask apps, control plane, scripts.
@@ -48,17 +48,17 @@ Inside the image, sites live at `/opt/WebSyn/<site>/`. The path predates the ren
 # fresh clone
 ./scripts/fetch_assets.sh                     # pulls assets from HF
 ./scripts/build.sh                            # docker build -t webharbor:dev .
-docker run -d -p 8101:8101 -p 40000-40023:40000-40023 webharbor:dev
+docker run -d -p 8101:8101 -p 40000-40028:40000-40028 webharbor:dev
 ```
 
 Or use the published image directly:
 
 ```bash
-docker run -d -p 8101:8101 -p 40000-40023:40000-40023 \
+docker run -d -p 8101:8101 -p 40000-40028:40000-40028 \
   battalion7244/webharbor:latest
 ```
 
-Sites are on `40000`-`40023` in the order declared by `SITES=( ... )` in `websyn_start.sh`. Control plane:
+Sites are on `40000`-`40028` in the order declared by `SITES=( ... )` in `websyn_start.sh`. Control plane:
 
 | Method | Path                | Purpose                                   |
 |--------|---------------------|-------------------------------------------|
@@ -136,13 +136,13 @@ python3 -m py_compile sites/<site>/app.py
 
 # 3. run on alt ports (don't collide with anything you already have running)
 docker run -d --rm --name wh-test \
-  -p 8201:8101 -p 41000-41023:40000-40023 webharbor:dev
+  -p 8201:8101 -p 41000-41028:40000-40028 webharbor:dev
 
 # 4. control plane healthy, all sites alive
 curl -s http://localhost:8201/health | python3 -m json.tool | head
 
 # 5. every site renders 200
-for p in $(seq 41000 41023); do
+for p in $(seq 41000 41028); do
   curl -so /dev/null -w "$p:%{http_code}\n" http://localhost:$p/
 done
 

CLAUDE.md

@@ -16,4 +16,4 @@ The full agent guide is loaded above via `@AGENTS.md`. The notes below apply onl
 
 ## Existing containers
 
-If a container is already running on `:8101` / `:40000-40023`, treat it as the user's working environment — don't `docker stop` or `docker rm` it without explicit confirmation. Spin up your test container under a different name on alt ports (`:8201`, `:41000-41023`).
+If a container is already running on `:8101` / `:40000-40028`, treat it as the user's working environment — don't `docker stop` or `docker rm` it without explicit confirmation. Spin up your test container under a different name on alt ports (`:8201`, `:41000-41028`).

CONTRIBUTING.md

@@ -24,7 +24,7 @@ git clone https://github.com/<you>/webharbor && cd webharbor
 ./scripts/fetch_assets.sh                       # pull current assets
 ./scripts/new_site.py mywebsite                 # OR edit an existing site
 ./scripts/build.sh && docker run -d --rm \
-  -p 8101:8101 -p 40000-40023:40000-40023 webharbor:dev
+  -p 8101:8101 -p 40000-40028:40000-40028 webharbor:dev
 # iterate locally...
 
 ./scripts/extract_assets.sh ../webharbor-static-pr/   # split assets out

Dockerfile

@@ -1,5 +1,5 @@
 # WebHarbor — slim, self-contained image.
-# 24 Flask mirror sites + control plane on :8101.
+# 29 Flask mirror sites + control plane on :8101.
 
 FROM python:3.12-slim-bookworm
 
@@ -50,10 +50,30 @@ RUN python3 /opt/check_asset_inventory.py /opt/WebSyn/walmart_careers && \
 RUN cd /opt/WebSyn/walmart_careers && rm -rf instance instance_seed && \
     PYTHONHASHSEED=0 python seed_data.py && rm -rf instance
 
+# FedEx validates its downloaded homepage media against the tracked inventory and
+# rebuilds its deterministic, version-marked SQLite seed from tracked source data.
+RUN python3 /opt/check_asset_inventory.py /opt/WebSyn/fedex
+RUN cd /opt/WebSyn/fedex && rm -rf instance instance_seed && \
+    PYTHONHASHSEED=0 python seed_data.py && rm -rf instance
+
+# WebMD Doctor's generated avatars / posters come from the pinned asset bundle,
+# while its SQLite seed is rebuilt deterministically from tracked source code.
+# The inventory gate enforces exact coverage + per-file SHA-256 + PNG decode of
+# all 317 generated images (same contract as the compass / walmart inventories).
+RUN python3 /opt/WebSyn/webmd_doctor/check_generated_assets.py
+RUN cd /opt/WebSyn/webmd_doctor && rm -rf instance instance_seed && \
+    PYTHONHASHSEED=0 python seed_data.py && rm -rf instance __pycache__
+# Healthline's downloaded seed carries tracked corrections (image reassignment) and the
+# pinned archive bundles unreferenced images; apply the deterministic migration and prune
+# the unreferenced files before they are shipped.
+RUN cd /opt/WebSyn/healthline && test -f instance_seed/healthline.db && \
+    PYTHONHASHSEED=0 python3 migrate_seed.py && \
+    python3 prune_unreferenced_images.py --apply && rm -rf instance
+
 COPY websyn_start.sh    /opt/websyn_start.sh
 COPY control_server.py  /opt/control_server.py
 COPY site_runner.py     /opt/site_runner.py
-RUN chmod +x /opt/websyn_start.sh
+RUN sed -i 's/\r$//' /opt/websyn_start.sh && chmod +x /opt/websyn_start.sh
 
 # OSU's real-site image bundle is required, while its database is generated
 # deterministically from tracked source data.
@@ -72,6 +92,6 @@ os.makedirs('instance_seed', exist_ok=True); \
 shutil.copy2('instance/rotten_tomatoes.db', 'instance_seed/rotten_tomatoes.db'); \
 print('Rotten Tomatoes seed DB generated at build time.')" && rm -rf /opt/WebSyn/rotten_tomatoes/instance
 
-EXPOSE 8101 40000-40023
+EXPOSE 8101 40000-40028
 
 CMD ["/opt/websyn_start.sh"]