[rgarcia]

Stacked on #9, which adds the harness pieces this uses (browser REPL and computer toolsets, --attempts, per-trial proxies and VM setup).

Summary

Adds retail-cart: one guest add-to-cart task on each of 16 retail and industrial-supply sites with heavy bot protection. Each task starts on the site's home page and asks the agent to put one item in the site's cart as a guest, by whatever route works (including a web search to identify the exact product or part number), and show the cart. No login, no checkout.

The agent ends each task by calling a finalize tool on a small stdio bench MCP server with its evidence and an outcome: success, failed, blocked (bot protection stopped it), website_error or kernel_error. The verifier then checks the cart itself. It reads the page the agent ended on if that is the cart, otherwise opens the task's cart_url or fetches its cart_api. It sets cart_verified when the item is listed, and cart_unverifiable when the cart couldn't be seen because the check hit a bot check or failed.

Arms

• codex-repl: Codex gpt-6-luna through browser_repl, stealth: true and no proxy, so each browser gets its own egress IP from the stealth pool
• codex-repl-site-config: same, with the config registry's per-site browser, proxy (a new one per trial) and guidance
• codex-repl-pinned: browser_repl plus computer_action, with fixed per-site settings from configurators/pinned/sites.toml:
  • stealth, gpu, and a new US ISP or residential proxy per trial
  • a macOS persona on some sites
  • vm_setup: on wbmason.com, empties the captcha-solver extension's Turnstile interceptor, which otherwise takes over the site's Cloudflare Turnstile check and never completes it
  • per-site guidance, e.g. reload once on zoro.com, the order-code pages on newark.com, the trailing-slash search on guitarcenter.com, add-by-part-number from the cart on mouser.com

The workflow runs 10 attempts per task by default.

Results

10 attempts per site, both arms in the same window, 2026-11-01. Counts are trials where the verifier found the item in the cart.

Site	codex-repl-pinned	codex-repl
costco.com	10/10	10/10
homedepot.com	10/10	10/10
lowes.com	10/10	10/10
walmart.com	10/10	10/10
dickssportinggoods.com	9/10	8/10
ebay.com	9/10	8/10
harborfreight.com	9/10	9/10
mouser.com	9/10	0/10
newark.com	9/10	0/10
staples.com	9/10	10/10
target.com	9/10	9/10
amazon.com	8/10	10/10
radwell.com	7/10	2/10
guitarcenter.com	4/10	0/10
wbmason.com	4/10	5/10
zoro.com	3/10	0/10
Total	129/160	101/160

• 3 more pinned trials (amazon 2, ebay 1) reported success but the cart check hit a bot check, so they count as unverifiable, not as passes.
• 6 pinned trials on residential-proxy sites (wbmason 3, zoro 2, mouser 1) failed before the agent started: installing Docker in the VM over the residential proxy failed.

Testing

• ruff check, ruff format --check, pytest (27 passed)
• bench prepare retail-cart for the static arms, added to CI
• smoke runs, then the 10-attempt run above