From 1db4134019c523f427eee7bbef4c5cdb341045a5 Mon Sep 17 00:00:00 2001 From: leetcrypt Date: Mon, 20 Jul 2026 09:30:46 -0700 Subject: [PATCH] =?UTF-8?q?docs(browserrot=20=C2=A71):=20authorized-princi?= =?UTF-8?q?pal=20reframe=20+=20human-second-factor?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Mirrors the Hard Rule 5 softening (kept in the local CLAUDE.md): rotation scope is provable per-credential authorization (self-owned OR recorded client consent), not operator ownership — enabling managed client rotation. Second factors are never bypassed/harvested/auto-submitted/simulated; challenges hand off to the live account holder. Stuffing/takeover primitives stay structurally absent. Co-Authored-By: Claude Opus 4.6 --- docs/BROWSERROT-PLAN.md | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/docs/BROWSERROT-PLAN.md b/docs/BROWSERROT-PLAN.md index 32a27f3..454df38 100644 --- a/docs/BROWSERROT-PLAN.md +++ b/docs/BROWSERROT-PLAN.md @@ -39,11 +39,15 @@ Node dependency, isolated behind an interface and a local socket. ## 1. Non-negotiable reframe (carry into every task) incredigo is **not** a bot-bypass/scraping tool. Per CLAUDE.md Hard Rule 5: -- **Self-owned accounts only, with the user's authorization.** -- **Never bypass MFA / CAPTCHA / email-confirm** — when one appears, the success marker - simply doesn't match, `Rotate` fails cleanly, the OLD secret is kept, and the human is - handed the change-URL by the existing worklist. (Already how `Rotate` behaves, - browserrot.go:175-180.) +- **Authorized principals only** — self-owned, or a client's delegated + *recorded* consent. + The invariant is provable, per-credential, auditable authorization, not operator ownership; + managed client rotation is in scope on that basis. +- **Never bypass, harvest, auto-submit, or simulate any second factor** (MFA / CAPTCHA / + OTP / push / email-confirm) — when one appears, the success marker simply doesn't match, + `Rotate` fails cleanly, the OLD secret is kept, and the challenge is handed to the **live + account holder** to complete before the flow resumes. (Already how `Rotate` behaves, + browserrot.go:175-180.) The two primitives a takeover/stuffing kit needs — unauthorized + scale + an automated second-factor defeat — are structurally absent and must stay absent. - "Stealth" here = **do not get false-flagged as a bot while doing a legitimate self-login**, NOT defeating a challenge. For a user logging into their own account from their own machine, most of the anti-bot arms race is already moot (real IP, real device, real user).