Skip to content

feat(website): one spec declares a site, composes it and checks any server (FD-4683) - #445

Closed
williamloo-scale wants to merge 26 commits into
mainfrom
wloo/website-spec
Closed

williamloo-scale wants to merge 26 commits into
mainfrom
wloo/website-spec

Conversation

@williamloo-scale

@williamloo-scale williamloo-scale commented Nov 2, 2026 •

Copy link
Copy Markdown
Contributor

Stacked on #444.

A website spec: one TOML file declares a site, composes from parts, and checks any server against it. Design: docs/website-spec.md.

  • agentenv_protocol.website.spec reads [site], [source], [data], [users], [roles], [routes.ops], [clock], [[uses]] and extends, with validation, overlays, composition, card params, from_card, from_environment, a JSON Schema and a CLI (validate, show, show --card).
  • A name table for a multi env: synthetic over live over the allowlist, two sites of one kind on a name refused.
  • @website(spec="website.toml"): the class is refused when its @api routes aren't the spec's, and its card is built from the spec. Notes now declares itself this way.
  • env.toml takes spec = "website.toml" or an inline [spec]; the env takes its name, health path and domains from it.
  • conformance --spec checks a server's card and routes against the spec; those checks are required.
  • Examples in examples/website/specs/: a replayed Slack overlay, an intranet, and an SSO component.

Live and replay sources, served_by and models = "mcp:..." are modelled in the spec but not deployable from env.toml yet.

Test

Unit suite: 12,793 passed (one GitHub-clone test from main, which hangs on the local machine on main too, deselected).

🤖 Generated with Claude Code

RetriggerView in GreptileConfidence Score: 5/5

No new blocking issue was confirmed in the reviewed changes.

Summary

Adds one website spec that describes a site, combines components, and checks a running server.

  • Website specs describe sites and combine reusable parts.
  • SDK site classes can take their routes and card details from a spec.
  • Website environments can take their site details from a spec.
  • Conformance checks compare a running site with its spec.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  TOML[Website spec] --> Resolve[Merge overlays and components]
  Resolve --> Validate[Check the combined spec]
  Validate --> SDK[WebsiteEnvironment and card]
  Validate --> Env[WebsiteEnv name, health and domains]
  Validate --> Check[Check a running server]
  SDK --> Check
Loading

Reviews (17) · Last reviewed commit: "fix(website): an overlay on a spec read ..." · Reviewed by Greptile

@williamloo-scale williamloo-scale changed the title website: one spec declares a site, composes it and checks any server (FD-4683) feat(website): one spec declares a site, composes it and checks any server (FD-4683) Nov 3, 2026
@williamloo-scale
williamloo-scale marked this pull request as ready for review November 3, 2026 00:24
@williamloo-scale
williamloo-scale requested a review from a team as a code owner November 3, 2026 00:24
williamloo-scale and others added 3 commits November 3, 2026 13:34
…'s websites as its MCP servers (FD-4683)

A website env, and a multi env's websites, get the harness treatment
MCP servers get: sync_env_clock syncs them (and tells them main's
timezone), snapshot_env exports each through its data plane and fails
on a site whose card can't be read, and an apply_server_config
broadcast reaches them; a site without the clock, a data plane or the
config extension is skipped.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…server the env card lists, at its own route (FD-4683)

The servers behind an env's gateway come from its card's
children_environments, each at its own /svc route, through new protocol
helpers (ChildEnv, children, child_at, child_named, serves), not from
the env's definition: a website sharing an MCP server's name is its own
server, and a card without data/get in its operations serves no v1 data
plane. The definition is read only for servers that serve no card, and
for a record whose card can't be read, logged.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…tract, and a conformance check tests any server (FD-4683)

This PR's change, rebased as one commit onto #427.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
… keep older sites and shared names working (FD-4683)

- The gateway answers 503 on a site's route while its card can't be read, rather than forwarding with nothing reserved.
- A plugin's MultiEnv record looks each child up by its kind, so a website and an MCP server may share a name.
- The state verifier reads a site its definition names but its card doesn't list at /svc/<name>/go, deprecated.
- The clock script is put in streamed HTML holding only what comes before <head>.
- Conformance fails a website/v1 ready that answers an HTTP error, whatever its body says.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
williamloo-scale added a commit that referenced this pull request Nov 3, 2026
…v (FD-4683)

This PR's change, rebased as one commit onto #445.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@williamloo-scale
williamloo-scale force-pushed the wloo/website-sdk-followups branch from 0ef31b9 to 615d6a0 Compare November 3, 2026 23:47
…ver HTTP client the test client uses (FD-4683)

After a sign-out the client's jar keeps the site's signed-out cookie under testserver.local, and setting the
forged one adds a second cookie of the same name. httpx2, which Starlette's TestClient uses when it is
installed (as on CodeBuild), sends the forged one first, so the site reads the valid signed-out cookie and
the test fails; httpx sends them the other way round. Clearing the jar first sends the forged cookie alone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
williamloo-scale and others added 11 commits November 3, 2026 20:06
…ses the conformance check (FD-4683)

This PR's change, rebased as one commit onto #428.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…s, and adds a note once per submit (FD-4683)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…sign-in fails, and reloads itself at its slash-ending address (FD-4683)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…hrough data/get, not /go (FD-4683)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…s, settles a save the server accepted, and reloads itself on its own origin (FD-4683)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…gers by route (FD-4683)

This PR's change, rebased as one commit onto #429.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
… conformance levels and models= (FD-4683)

This PR's change, rebased as one commit onto #443.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
… so its own export loads back (FD-4683)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…rents first, so its export loads back (FD-4683)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…dels= sites; data/get alone (FD-4683)

- The store keeps no sessions: no `?sid=`, no `agentenv_sid_<name>` cookie, no `changed_sessions`; `self.store` is the
  site's one store, which the data plane loads, exports and resets.
- A models= site keeps no initial state and no diff; its data plane is its database's.
- Conformance runs the round trip with no skip for changed state or sessions.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…hole and restores enum columns as their members (FD-4683)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
williamloo-scale added a commit that referenced this pull request Nov 4, 2026
…v (FD-4683)

This PR's change, rebased as one commit onto #445.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@williamloo-scale
williamloo-scale force-pushed the wloo/website-sdk-followups branch from 0f672be to 3184f79 Compare November 4, 2026 04:40
williamloo-scale and others added 8 commits November 3, 2026 20:54
…ength parents first, without recursing (FD-4683)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…erver (FD-4683)

This PR's change, rebased as one commit onto #444.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…nds fields, and fails a cookie card for a spec without one (FD-4683)

- A spec derived from a WebsiteEnvironment's decorators keeps each @api route's name as @api takes it; an authored
  spec's route names are still checked.
- An extends whose uses or data.collections has the wrong type is a SpecError naming the field, not a TypeError.
- The conformance spec check fails a card with a session cookie or path when the spec doesn't sign in by cookie.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…ma takes a route's method in either case (FD-4683)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…s in lower case and keeps the route names it serves (FD-4683)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…through data/get (FD-4683)

- The spec has no `[state]` section (`read = "data_plane" | "go" | "diff"`, `path`), no `STATE_PATH` and no
  `state_path`; `to_card_extension`, `from_card`, `from_environment` and `problems_with_environment` carry no state.
- The examples, the spec doc and conformance's spec check drop it too.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
… the spec no longer takes (FD-4683)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…e route names its server serves (FD-4683)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@earakely-scale
earakely-scale force-pushed the wloo/website-sdk-followups branch 2 times, most recently from f4ac35d to 190bfd1 Compare November 6, 2026 00:27
Base automatically changed from wloo/website-sdk-followups to main November 6, 2026 02:20
@earakely-scale

Copy link
Copy Markdown
Collaborator

Closing in favour of FD-4931. Decided Nov 6: a website env is declared by its env.toml, as every bundle entry is, with no separate website.toml. env.toml holds the facts agentenv needs before a site runs (its domains first, stored on WebsiteEnv, with per-site overrides and put-time refusal of a name claimed twice), and the card a site serves stays its contract (routes, roles, sign-in, clock, tools). The spec's overlays, components, sources and name table are left out until something serves them; computer site routing keeps #448's site table.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants