Trilltechnician/incredigo
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

docs(browserrot §1): authorized-principal reframe + human-second-factor

Browse Source 
Mirrors the Hard Rule 5 softening (kept in the local CLAUDE.md): rotation scope
is provable per-credential authorization (self-owned OR recorded client consent),
not operator ownership — enabling managed client rotation. Second factors are
never bypassed/harvested/auto-submitted/simulated; challenges hand off to the
live account holder. Stuffing/takeover primitives stay structurally absent.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
leetcrypt
2026-07-20 09:30:46 -07:00
parent c2f08d1a21
commit 1db4134019
1 changed files with 9 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/BROWSERROT-PLAN.md
+9 -5
View File
@@ -39,11 +39,15 @@ Node dependency, isolated behind an interface and a local socket.
## 1. Non-negotiable reframe (carry into every task) ## 1. Non-negotiable reframe (carry into every task)
incredigo is **not** a bot-bypass/scraping tool. Per CLAUDE.md Hard Rule 5: incredigo is **not** a bot-bypass/scraping tool. Per CLAUDE.md Hard Rule 5:
- **Self-owned accounts only, with the user's authorization.** - **Authorized principals only** — self-owned, or a client's delegated + *recorded* consent.
- **Never bypass MFA / CAPTCHA / email-confirm** — when one appears, the success marker The invariant is provable, per-credential, auditable authorization, not operator ownership;
simply doesn't match, `Rotate` fails cleanly, the OLD secret is kept, and the human is managed client rotation is in scope on that basis.
handed the change-URL by the existing worklist. (Already how `Rotate` behaves, - **Never bypass, harvest, auto-submit, or simulate any second factor** (MFA / CAPTCHA /
browserrot.go:175-180.) OTP / push / email-confirm) — when one appears, the success marker simply doesn't match,
`Rotate` fails cleanly, the OLD secret is kept, and the challenge is handed to the **live
account holder** to complete before the flow resumes. (Already how `Rotate` behaves,
browserrot.go:175-180.) The two primitives a takeover/stuffing kit needs — unauthorized
scale + an automated second-factor defeat — are structurally absent and must stay absent.
- "Stealth" here = **do not get false-flagged as a bot while doing a legitimate self-login**, - "Stealth" here = **do not get false-flagged as a bot while doing a legitimate self-login**,
NOT defeating a challenge. For a user logging into their own account from their own machine, NOT defeating a challenge. For a user logging into their own account from their own machine,
most of the anti-bot arms race is already moot (real IP, real device, real user). most of the anti-bot arms race is already moot (real IP, real device, real user).