feat(website): a session cookie per site, the clock's rate, conformance levels and models= (FD-4683) by williamloo-scale · Pull Request #444 · scaleapi/agentenv-framework

williamloo-scale · 2026-11-02T19:10:12Z

Stacked on #443.

Website SDK follow-ups.

Session cookie per site. agentenv_session_<name>, named on the card, so two sites under one gateway host don't overwrite each other's. The shared agentenv_session is still read for one release.
Clock rate. /clock/time also answers virtual_seconds_per_real_second, which UniverseClock follows instead of inferring it.
Conformance: required vs recommended. Only what website/v1 requires of any server fails a run: any host, health, no page at the reserved paths (new), the data-plane round trip. The card's details, X-Universe-Now, clock, forwarded headers and cookies warn; --strict fails on a warning.
@website(models=...). An object with load/export/reset, or SQLAlchemy models. With models the site gets self.db on DATABASE_URL, and the data plane reads those tables, so the GUI and the MCP tools share rows.

Before merging

models= adds an optional db extra (sqlalchemy>=2.0), included in dev, and updates uv.lock. SQLAlchemy is imported only when a site uses models.

Test

Unit suite: 12,625 passed; the models= tests (6) also pass with SQLAlchemy installed.

🤖 Generated with Claude Code

Confidence Score: 5/5

The PR appears safe to merge with the warning-handling fix from PR #446.

Summary

Adds per-site cookies, explicit clock rates, required and recommended conformance checks, and database-backed sites through models=.

Website pages and data tools can share rows in a site’s database.
The conformance checker separates required checks from recommended ones.
Each website uses its own session cookie name.
Website clocks follow the rate reported by the gateway.

_{Reviews (16) · Last reviewed commit: "fix(website): a models= site orders a se..." · Reviewed by Greptile}

socket-security · 2026-11-03T18:01:04Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/psycopg@3.3.7

View full report

… conformance levels and models= (FD-4683) This PR's change, rebased as one commit onto #443. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

… so its own export loads back (FD-4683) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

…rents first, so its export loads back (FD-4683) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

…dels= sites; data/get alone (FD-4683) - The store keeps no sessions: no `?sid=`, no `agentenv_sid_<name>` cookie, no `changed_sessions`; `self.store` is the site's one store, which the data plane loads, exports and resets. - A models= site keeps no initial state and no diff; its data plane is its database's. - Conformance runs the round trip with no skip for changed state or sessions. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

…hole and restores enum columns as their members (FD-4683) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

…ength parents first, without recursing (FD-4683) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

This was referenced Nov 2, 2026

feat(website): one spec declares a site, composes it and checks any server (FD-4683) #445

Open

feat(website): WebsiteEnvironment serves a site on the website/v1 contract, and a conformance check tests any server (FD-4683) #428

Open

williamloo-scale changed the title ~~website: per-site session cookie, /go?sid=, clock rate, conformance levels, models= (FD-4683)~~ feat(website): a session cookie per site, /go?sid=, the clock's rate, conformance levels and models= (FD-4683) Nov 3, 2026

williamloo-scale marked this pull request as ready for review November 3, 2026 00:24

williamloo-scale requested a review from a team as a code owner November 3, 2026 00:24