Review: MEGA mirror + task verifiers (site by @plzdoo, verifiers by reviewer)

[Lxr-max]

This PR is the review vehicle for #2 (feat(mega): add new site, site folder sites/mega, original site by @plzdoo). It does not merge #2 itself.

Rebased onto current aiming-lab/WebHarbor main (e18826a, 45 sites ending at Y Combinator / 40044). MEGA is appended at index 45 / port 40045 so existing ports stay put (Google Flights 40007, ESPN 40014, Cookpad 40040). This does not take Best Buy’s claimed 40040 from #135/#48.

Fork work branches:

• https://github.com/Lxr-max/WebHarbor/tree/cursor/review-mega-55ad (this PR)
• https://github.com/Lxr-max/WebHarbor/tree/cursor/review-mega-d6c9 (same commits)

Site commits keep original authorship (yimingl9 <yimingl9@illinois.edu>). Reviewer commits are Lxr-max <xuanrui.li@se24.qmul.ac.uk>.

Lineage

Item	Detail
Contributor PR	#2 — plzdoo:main, tip d1abd2c (yimingl9 <yimingl9@illinois.edu>), port 40015 / 16-site era
Cherry-pick	d1abd2c onto current main as c4b84ce — only sites/mega/** (registry files were not taken from contributor main)
This PR	Re-slot + mechanical fixes + grading contract on current aiming-lab/WebHarbor main

Slot after rebase onto current main

• Site slug: mega
• Index: 45 (after y_combinator)
• Container port: 40045 (http://localhost:40045/)
• Registry: websyn_start.sh, control_server.py, Dockerfile EXPOSE 8101 40000-40045 (46 sites)

Tasks and grading contract

• 18 / 18 tasks accepted (MEGA--0 … --17)
• 18 deterministic verifiers: sites/mega/verify/verify_0.py … verify_17.py plus verify_lib.py
• tasks.jsonl has verifier_path + English judge_rubric (rules/checkpoints only — no answer key)
• web URLs updated from outdated 40015 / previous review 40028 → http://localhost:40045/
• Harness: sites/mega/verify/test_verifiers.py

Reviewer fixes on this branch

• Safe form parsing (form_int / form_float), password length on register, Cloud Drive folder/upload path normalization.
• Plan detail now shows Users included; Cloud Drive listing no longer leaks N items counts.
• S4 Fixed Storage tagline no longer says “S3-compatible” (that wording stays on the plan-detail features only).
• Unused harvested CSS buttons.css.css / theme.css.css are not linked (base.html loads mega.css only) — left in place; they do not break loading.

Task re-anchors (knowledge-shortcut / ill-posed)

• MEGA--0/1/10/11/13/15: require a specific on-page fact, not “open a page”.
• MEGA--2: uniquely Pro II (8 TB + MEGA VPN in features), yearly, no purchase (Pro III also has ≥8 TB).
• MEGA--5: share Atlas b-roll (seed launch footage was already shared with Bob/Carol).
• MEGA--12: object-storage filter + S3-compatible API feature on the detail page.
• Login tasks now include password: TestPass123!.

Conflict resolution (rebase)

Conflicts vs current main were in registry/docs only (websyn_start.sh, control_server.py, Dockerfile, README.md, AGENTS.md, CLAUDE.md, CONTRIBUTING.md, agent_demo/README.md). Resolution: keep every current-main site and append mega. No Best Buy, Google Flights, or ESPN files were edited.

sites/drugs_com/tests/test_integration.py was updated lockstep with the 46-site registry (that test freezes the exact SITES list / EXPOSE range).

Assets / blockers (not merge-ready until these land)

1. HF pin does not contain mega.tar.gz. .assets-revision remains eedc1a7f85118ab835eac38e04678fa85d141973 (current main; 45 registered-site archives). Contributor bytes live on HF discussion Add TED mirror site #1 / commit 8997072c and were rebased onto dataset main as open HF PR #87 (sha256 cb989a9a2026fafd8c0def8055c08f7fb866822882d764439de7fe56d85e08f3). Do not pin 8997072c or the unmerged Add source-backed Rotten Tomatoes mirror (port 40021) with deterministic verifiers #87 commit (would drop other archives / violate the immutable-merged-SHA rule). scripts/fetch_assets.sh, scripts/check_assets.sh, and scripts/tests/test_scoped_assets.py will fail for sites/mega until Add source-backed Rotten Tomatoes mirror (port 40021) with deterministic verifiers #87 is merged and this pin is bumped.
2. No Docker in this rebase environment, so byte-identical /reset/mega inside the full image was not repeated here. That needs a re-run on the 46-site image after assets are pinned.
3. Seed DB is generated from seed_data.py. The frozen instance_seed/mega.db must ship via HF, not git.

Commits on this branch

| Commit | Author | Content |
|---|---|
| c4b84ce | yimingl9 | feat(mywebsite): add new site (cherry-pick of d1abd2c, sites/mega/** only) |
| 030599d | Lxr-max | harden forms, folders, and plan-detail leaks |
| a947cc1 | Lxr-max | add deterministic task verifiers |
| 2a89be1 | Lxr-max | re-slot onto current main (index 45 / port 40045) |

[Lxr-max]

HF assets PR opened

Opened a new Hugging Face dataset PR with mega.tar.gz rebased onto current ChilleD/WebHarbor main (existing archives preserved):

https://huggingface.co/datasets/ChilleD/WebHarbor/discussions/87

• Same bytes as contributor discussion Add TED mirror site #1 / commit 8997072c
• sha256 cb989a9a2026fafd8c0def8055c08f7fb866822882d764439de7fe56d85e08f3 (24,209,535 bytes)
• validate_asset_archive.py: 135 managed members

Once #87 is merged, we can bump .assets-revision on this PR to the new HF merge sha. Do not pin to 8997072c (would drop other site archives).

[Lxr-max]

Rebased onto current main — HF pin still blocked

Force-pushed cursor/review-mega-55ad after rebasing onto aiming-lab/WebHarbor main (e18826a). Same commits also live on cursor/review-mega-d6c9.

Conflicts resolved

Registry/docs only: websyn_start.sh, control_server.py, Dockerfile, README.md, AGENTS.md, CLAUDE.md, CONTRIBUTING.md, agent_demo/README.md. Kept every current-main site and appended mega at index 45 / port 40045 (EXPOSE 8101 40000-40045, 46 sites). Did not insert after kaggle (that would have shifted NVIDIA–Y Combinator). No Best Buy / Google Flights / ESPN files were touched; Cookpad stays at 40040.

Assets pin: still waiting

.assets-revision SHA is unchanged: eedc1a7f85118ab835eac38e04678fa85d141973 (no mega.tar.gz on that pin).

Open HF dataset PR: https://huggingface.co/datasets/ChilleD/WebHarbor/discussions/87

• Same bytes as discussion Add TED mirror site #1 / 8997072c
• sha256 cb989a9a2026fafd8c0def8055c08f7fb866822882d764439de7fe56d85e08f3
• HF Add source-backed Rotten Tomatoes mirror (port 40021) with deterministic verifiers #87 is still open (not a merged revision)

Do not pin 8997072c or the unmerged #87 commit. After #87 merges onto ChilleD/WebHarbor main, bump .assets-revision to the immutable merge SHA and re-run fetch / test_scoped_assets.py / /reset/mega byte-identity. Until then this PR is not merge-ready on the asset contract (fetch_assets.sh and the registered-archive manifest check will fail for mega).

[Lxr-max]

Verification after rebase (what actually ran)

Code-side, on 2a89be1:

• python3 scripts/check_site_registry.py — 46 sites consistent, EXPOSE 8101 40000-40045, MEGA tasks at http://localhost:40045/
• python3 -m py_compile of sites/mega/app.py, seed_data.py, and all 18 verifiers — OK
• Flask test_client (generated seed, no HF images): /, /pricing, /storage, /login, /downloads, /help all 200; 19 plans / 4 users
• python3 sites/mega/verify/test_verifiers.py against that generated seed — all verifier matrix checks passed (no-op / shortcut / wrong-answer / pass / stateful mismatch)
• drugs.com lockstep tests test_exact_46_site_registry_and_ports, test_docker_and_docs_use_46_site_range, test_hf_pin_is_immutable_merged_45_archive_revision — PASS (pin SHA still eedc1a7f…)
• scripts/tests/test_scoped_assets.py::test_manifest_matches_global_pin_and_registered_archive_set — FAIL as expected: mega.tar.gz is not in assets-manifest.json / current pin

Not run: Docker image, /reset/mega byte-identity, fetch_assets.sh (blocked on HF #87). HF #87 is still open; its commit parent is b7e605c0 (older dataset main) but Hugging Face currently reports filesWithConflicts: [] for an add-only mega.tar.gz. Do not bump .assets-revision until #87 is merged and the merge SHA is checked for mega.tar.gz.