[williamloo-scale]

Stacked on #443.

Website SDK follow-ups.

• Session cookie per site. agentenv_session_<name>, named on the card, so two sites under one gateway host don't overwrite each other's. The shared agentenv_session is still read for one release.
• /go?sid=. Each sid is a store of its own started from the seed, the CUA-Gym convention the website state verifier reads. A request runs in its ?sid=, else the one its browser last named (<cookie>_sid), else the default session, which is the data plane's state as before.
• Clock rate. /clock/time also answers virtual_seconds_per_real_second, which UniverseClock follows instead of inferring it.
• Conformance: required vs recommended. Only what website/v1 requires of any server fails a run: any host, health, no page at the reserved paths (new), the data-plane round trip. The card's details, X-Universe-Now, clock, forwarded headers and cookies warn; --strict fails on a warning.
• @website(models=...). An object with load/export/reset, or SQLAlchemy models. With models the site gets self.db on DATABASE_URL, and the data plane and /go read those tables, so the GUI and the MCP tools share rows.

Before merging

models= adds an optional db extra (sqlalchemy>=2.0), included in dev, and updates uv.lock. SQLAlchemy is imported only when a site uses models.

Test

Unit suite: 12,625 passed; the models= tests (6) also pass with SQLAlchemy installed.

🤖 Generated with Claude Code

Confidence Score: 5/5

No new blocking issue remains when assessed with the verified changes in PRs #446 and #469.

Summary

This PR adds per-site cookies, named stores through sid, explicit clock rates, required and recommended conformance checks, and database-backed websites through models=.

• Each website keeps its own sign-in cookie and named browser sessions.
• Website routes and data tools can share rows through SQLAlchemy models.
• The conformance check separates required website rules from recommended SDK behavior.
• Gateway clocks report their rate, and website clocks follow it.

_{Reviews (12) · Last reviewed commit: "fix(website): a models= site loads a sel..." · Reviewed by Greptile}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​psycopg@​3.3.7

View full report