---
name: monitor-public-web-changes
description: Monitor one authorized public HTTPS page for meaningful text changes and produce privacy-safe JSON evidence. Use when Codex needs to initialize or update a local page snapshot, compare a current public page with its prior snapshot, suppress known line-prefix noise, or prepare a deterministic website-change receipt without browser automation, credentials, cookies, redirects, page interaction, or private-network access.
---

# Monitor Public Web Changes

Use the bundled dependency-free Python CLI to fetch one public HTTPS page, normalize its HTML, text, or JSON content, compare it with a local state file, and emit a bounded JSON receipt.

## Run the workflow

1. Confirm the buyer owns the page or is authorized to monitor it. Accept only public information.
2. Reject URLs containing credentials, non-HTTPS schemes, non-443 ports, or hosts resolving to non-public IP space.
3. Initialize a snapshot:

```bash
python3 scripts/web_change_monitor.py \
  --url https://example.com/status \
  --state snapshot.json \
  --report report.json
```

4. Run the same command later. Interpret `status` as:

- `initialized`: no earlier snapshot existed.
- `unchanged`: normalized text is identical.
- `changed`: meaningful normalized text differs; inspect `diff` and `similarity`.

5. Use `--ignore-line-prefix 'Last checked:'` only for stable, buyer-approved volatile line prefixes. Repeat the flag for at most ten prefixes.
6. Verify the report against [references/report-schema.json](references/report-schema.json) when a machine-checkable handoff is required.

## Preserve safety and evidence

- Keep the state and report local. The state contains normalized public page text; the report contains only bounded changed-line excerpts.
- Do not add authentication, cookies, form submissions, JavaScript execution, redirects, proxy use, CAPTCHA handling, scraping evasion, or notification delivery.
- Do not monitor private, loopback, link-local, reserved, multicast, credential-bearing, or non-HTTPS targets.
- Do not claim continuous uptime. The CLI performs one read-only check per invocation; the buyer controls scheduling.
- Treat results as change evidence, not legal, compliance, availability, or security conclusions.
- Record the exact URL, response hashes, selected headers, normalized length, prior hash, similarity, and CLI version in the receipt.
- If DNS changes between validation and connection, or the page is controlled by a hostile party, use a buyer-managed egress allowlist rather than this bounded edition.

## Test before delivery

Run:

```bash
python3 -m unittest scripts/test_web_change_monitor.py
python3 -m py_compile scripts/web_change_monitor.py
```

Do not deliver if either command fails.