Review: 4shared mirror + task verifiers (site by @sarendis56, verifiers by reviewer)

[JeremyJC67]

Summary

Review vehicle for #90 (feat(4shared): add 4shared mirror by @sarendis56). It carries the contributor's two commits unchanged in authorship, rebased onto current main, plus the reviewer's integration and grading-contract commits:

commit	author	what
feat(4shared): add 4shared mirror	@sarendis56	site (rebased; the registration hunk that conflicted with main was dropped from this commit and redone below)
fix(4shared): harden mirror and replace placeholder assets	@sarendis56	contributor's hardening pass
chore(4shared): integrate as site 25 — port 40024, docs sweep, registry tests	reviewer	websyn_start.sh / control_server.py append 4shared as the LAST entry (index 24 → 40024, provisional); Dockerfile 25 sites / EXPOSE 8101 40000-40024; README / AGENTS / CONTRIBUTING / CLAUDE / agent_demo README sweep; walmart_careers + rotten_tomatoes registry tests bumped to 25; tasks.jsonl web → 40024; app.py SITE_PORT → 40024
fix(4shared): re-anchor task 2 off the first result; disambiguate task 16's plan	reviewer	two task rewordings (see review comment)
test(4shared): deterministic verifiers, judge rubrics and LLM-free validation matrix	reviewer	sites/4shared/verify/ (verify_lib + 20 verifiers + README), verifier_path + judge_rubric on all 20 rows, verify/tests/ harness

Full review (mechanical / visual / functional / per-task audit, evidence and screenshots) is posted on #90.

What was verified (standalone on the review server, Playwright, no LLM)

• Asset tarball from HF discussion feat(webmd): add WebMD mirror site (20 tasks, hardened) #62 (refs/pr/62 = f426447ee209071110a5de80026a72d049bbd97f): validate_asset_archive.py OK (30 members, no ._*/.DS_Store), sha256 f50985a7… matches the PR body; seed DB md5 b577adc216900a6f0e3974a80e51c04c (matches the contributor's claim).
• Byte-identical instance/ vs instance_seed/ after first boot, after a full read-only Playwright sweep, and after two further boots from seed.
• 122 public files across 7 categories, 16/16 image records render real photographs (no broken/placeholder images), every footer route 200, 404 page, private-file access control (non-owner → 404).
• Write paths driven end to end: login / wrong password / register + re-login / duplicate email, favorites add+remove, save, account edit, folder create + duplicate guard, upload (auto-category, validation), rename, move, trash → restore (confirm dialog), share link (+ public /shared/<token> page), comments, download → activity, premium checkout (100 GB / 500 GB / 1 TB pages, card validation).
• Registry tests on this branch: test_exact_25_site_registry_and_port, test_docker_preserves…, test_shared_documentation_uses_25_site_range, test_no_merge_conflict_markers…, rotten_tomatoes test_task_manifest_and_registry — all pass. bash -n websyn_start.sh, py_compile of control_server/site_runner/site files OK, no cross-site imports.

Grading contract validation

verify/tests/drive_tasks.py drove all 20 tasks with a real Chromium against a freshly seeded standalone instance (agent.py trajectory format, initial.db/after.db snapshots); verify/tests/run_matrix.py then derived the negative variants and ran every verifier with --no_llm True:

variant	expectation	result
no-op (homepage only, empty answer, clean DB)	20 × FAIL	20/20
genuine Playwright run	20 × PASS	20/20
shortcut (correct answer + correct DB, every URL = homepage)	20 × FAIL	20/20
wrong answer / wrong persisted row	20 × FAIL	20/20
state-mismatch (stateful tasks 6–19, after.db = seed)	14 × FAIL	14/14

agent_demo/eval_judge.py --run_dir … --verifier True runs the verifier and exits 0 on the genuine run, 1 on the no-op.

Pending before merge

1. Merge HF discussion feat(webmd): add WebMD mirror site (20 tasks, hardened) #62 and repin .assets-revision to the resulting immutable commit — neither the PR-era pin (070123d7…, 26 files) nor current main's pin (65c479f8…, 27 files) contains 4shared.tar.gz; refs/pr/62 does (14,209,943 bytes).
2. Docker mechanical checks — done from this branch with refs/pr/62 assets: build ok (4.72 GB), 25/25 sites 200, /health 25/25, POST /reset/4shared byte-identical (b577adc2…) before/after a dirty request and after docker restart, /reset-all 25/25 in 1.76 s, verifier no-op matrix in the container 20/20 FAIL, registry tests green.
3. Port 40024 is provisional (last SITES entry); the maintainer may reassign at merge — tasks.jsonl web and app.py SITE_PORT follow.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AkNTAZMziDodR6uqa6QBtP

[JeremyJC67]

Rebased onto the 26-site main — this branch is now site 27 / port 40026

main merged FedEx (40024) and WebMD Doctor (40025) overnight, which put every open site
branch into conflict. This branch has been brought up to date by merging main rather than
rebasing, so every contributor and reviewer commit is preserved verbatim, and re-slotted to
index 26 / port 40026: registry, Dockerfile EXPOSE, the shared docs and every
site-local port reference follow. The slot is provisional as always — say the word at merge
time and I will re-slot in whatever order you land things.

The whole environment was then rebuilt and re-verified at the new slot:

check	result
HTTP sweep	27/27 return 200
GET /health	ok, 27/27 alive and ready
POST /reset/4shared → md5	b577adc216900a6f0e3974a80e51c04c, identical to the seed
POST /reset-all	ok, 27/27 ready, 1.59 s
verifier no-op matrix	20/20 FAIL
registry + docs tests	4 passed, 3,343 subtests

Audit assertions hold: GET /logout 405, POST /upload without a session/token 400, unknown
route a branded 404 (3,029 bytes), anonymous /account 302, the Documents tab present in the
search category strip, and six read-only page loads leave the DB byte-identical.

Still blocked only on HF #62 being merged, after which I repin .assets-revision.