feat(catalog): ship-a-website — an agent buys its own website on a $40 delegation

[r-marques]

Summary

Adds the Ship It While I'm In the Shower Catalog outcome as a reproducible tutorial under catalog/ship-a-website/ and a recap page on the showcase (/t/ship-a-website).

A coding agent (Claude Code + the nevermined-router plugin) was given one prompt and a $40 / 24 h delegation. It registered shippeditself.com, paid for hosting, bought a screenshot of itself, pushed the source to GitHub and published the receipt on the page; later it bought the narration and music for the walkthrough video from the same budget. 41 settled payments to 4 vendors over x402 (Base) and MPP (Tempo), $21.67 drawn from the cap, zero human clicks after setup.

• README.md — the tutorial (why, step by step, the prompt, the receipt, reproduce it, what we learned)
• BRIEF.md, agent/CLAUDE.md, demo-prompt.txt — exactly what the agent was given
• BUILD_LOG.md — the agent's own run log; FRICTION.md — what broke, reproductions, what was reported
• receipt/receipt.json — one row per payment with its tx hash; hero.png — the screenshot it bought
• showcase/content/tutorials.ts + Dockerfile + public/media/ship-a-website/ — the recap page, EN/ES VTT tracks

Still to land before ready-for-review

• catalog/ship-a-website/ship-a-website.mp4 — the final cut (v5)
• YouTube link in the README (https://youtu.be/Wg-7go30WRs, unlisted until the site embed lands)

Supersedes the standalone nevermined-io/outcome-ship-a-website repo, which will be archived with a pointer here.

Test plan

• npx tsc --noEmit and npm run build in showcase/ pass locally (23 static pages)
• PR verify job (build + sandbox self-check)
• /t/ship-a-website renders with the video and both subtitle tracks once the mp4 lands

🤖 Generated with Claude Code

https://claude.ai/code/session_011ydvkGuXEHBxxfmJFoDMqB

[eruizgar91]

👀 pr-review-bot (fallback) picking this up.

[eruizgar91]

Reviewed catalog/ship-a-website/ plus the /t/ship-a-website recap entry at 8dc023a. This is a strong, unusually verifiable content PR — the substance holds up under checking, and most of what I set out to disprove came back clean. Seven findings, all inline: four MEDIUM (two missing wiring/index updates that every prior catalog PR made, one false claim about what is committed, one video-provenance gap) and three LOW. No blockers.

What I checked and found clean

• receipt/receipt.json is internally consistent and, byte-for-byte, identical to what https://shippeditself.com/receipt.json serves right now — 41 rows, 41 unique requestIds, 41 unique well-formed tx hashes, all Settled, totals matching the row sums exactly ($21.0030 amount, $0.41886 fee) and stats.spentCents: 2167 matching the $21.67 quoted in the README, in BUILD_LOG's v4 section and in the showcase warn string. The $21.67 vs $21.42 gap is explained correctly in both README and BUILD_LOG.
• The new tutorials.ts entry type-checks against lib/types.ts (RecapRun / DataTable), totalRow: 4 correctly indexes the Total row, and protocol / language / tier / repoPath all follow the existing entries' conventions. Every tech.files path resolves through repoFileUrl, and every page/layout/index render site is data-driven off the tutorials array — nothing else in showcase/ needed a per-slug change.
• Both .vtt files are valid WebVTT and are byte-identical to what sync-media.sh's own srt→vtt transform would produce from the committed .srt; <track> attributes match the established pattern (default: true on en only). EN and ES are line-for-line translations of each other and neither quotes a figure that disagrees with the receipt.
• No credentials anywhere: grepped every added text file for JWTs, sk_/gh*_/AKIA keys, PEM headers and private keys — zero hits. BUILD_LOG narrates two real JWT-leak incidents but never prints a token; sampled video frames around those timestamps show no token text.
• showcase/Dockerfile's new COPY line is correct and its source is in the build context (.dockerignore excludes nothing under catalog/). Every external link resolves 200 (shippeditself.com, the YouTube cut, the pushed repo, both docs pages).

Considered and deliberately not filed

• "none of which it had an account with" vs BUILD_LOG's isNewWorkspace: false (the wallet already had a Locus workspace). The README's own step table says the agent "signs up at the host with its wallet address (free)", so the claim's meaning — no human-onboarded, card-on-file account — holds; the pre-existing workspace is a rehearsal artifact and is disclosed. Not a contradiction.
• "Human clicks after setup: zero" vs the operator-directed v3/v4 passes. In context ("Most demos stop where money starts: a person signs up at each vendor, enters a card") this reads as vendor-side clicks, and no human authorized a purchase. Defensible as written.
• Committing hero.png twice (catalog/ + showcase/public/media/) and not mirroring the .srt under showcase/public/ the way the other three slugs do — both are layout-only, no runtime effect.
• The 10 MB .mp4 committed to git rather than LFS — matches existing practice for the other three demos; not this PR's to change.
• build-push is skipping on this PR by design, so the Dockerfile line is unexercised until it lands on main. Correct by inspection; noting it so a green Verify isn't over-read.

Verdict is the caller's to post.

[eruizgar91]

🟡 Approved with comments — no blockers; 4 should-fix, 3 nit(s) left inline.

Inline review: #80 (review)