spb/websensor

- Deep discovery (robots → sitemaps → feeds incl. official sub-domains → navigation-classified pages → status providers → GitHub org → EDGAR → Hugging Face → OpenAPI → posture), every candidate validated, wildcard DNS / anti-bot detection, content de-duplication, expected change frequency (median gap)
- Factory: coverage universes → factory_seeds → scored candidates (explainable) → promotion caps → SHADOW sensors (polled, never published) → evidence-based acceptance/rejection; separate websensor-factory process with Redis heartbeat; CLI expand/factory seed|run|evaluate|stats|export|requeue; YAML export for graduation
- Migration 0007 (sources.origin/sector, factory_seeds, candidate lifecycle columns, factory_daily); pipeline keeps SHADOW status and skips events for shadow sensors
- Coverage: sector universes schema + validator (--dns), registrableDomain(), GET /api/v1/coverage[/:sector], pages /coverage and /coverage/[sector], homepage rail, stats exclude shadow sensors
- Admin API /api/v1/admin/factory* + /ops Source Factory panel (funnel, sectors, candidates, accept/reject)
- Docs: COVERAGE.md, CLAUDE.md, deploy README, ARCHITECTURE, README; manifest gains websensor-factory + factory seed hook; version 0.3.0

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

- config/sources.d/*.yaml merged on top of the founding file by apps/engine/src/seeds.ts (`extend: true`
  adds sensors to an existing source); classes: open source, central banks & finance, energy/climate/weather,
  telecom & internet infra, retail/consumer/travel, gaming & entertainment, universities & research,
  international orgs/NGOs/standards, sports, crypto, transport/aviation/space, consumer safety/food/agri,
  housing/labour/open data, enterprise SaaS, health systems & medtech, politics/elections/courts, SEC EDGAR
  (254 issuers), package registries, web posture, OpenAPI, status JSON, documents & data
- connectors: package (10 registries), edgar, statusjson (Instatus/incident.io/Status.io), openapi, csv, pdf
  (unpdf), dns, tls, headers, rdap (IANA bootstrap); fetcher keepAllHeaders
- heuristics: connector-class priors + event types api_change, dns_change, domain_registration_change,
  crawler_policy_change; 8-K items → earnings/leadership_change/breach/acquisition
- registry validator without DB (apps/engine/src/validate.ts, --probe), generators gen-edgar.py,
  gen-web-posture.py, prune-fragment.py; docs/registry/AUTHORING.md + docs/connectors/*.md (16)
- SSRF: NAT64 addresses judged by the embedded IPv4 (IPv6-only hotspots)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Core (taxonomy, SSRF policy, canonical extraction, diff engines, heuristics, scoring, adaptive schedule),
db (SQL migrations + Drizzle), content-addressed zstd blob store, connectors (http, rss/atom, sitemap,
statuspage, github, jsonlist, discovery, scrapfly fallback), engine (scheduler, pipeline, Claude
interpretation, entities, novelty/clustering, silent changes, metrics), Fastify gateway (REST + WebSocket +
proxy), Next.js 16 frontend, 200-source registry, tests, docs, mld manifest.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>