captchaforge 0.2.36

[DO NOT USE — UNDER ACTIVE DEVELOPMENT, NOT PRODUCTION-READY] Captcha solver scaffolding for chromiumoxide-driven browsers. The architecture is in place (vendor solvers, retry-loop iframe walking, VLM provider abstraction, real-WAF bench harness) but the live-vendor success rate is still 0% — Cloudflare Turnstile / hCaptcha / reCAPTCHA detect us at a TLS / CDP fingerprint layer that no flag-based stealth has cleared. Watch the repo; do not depend on this for any real workload.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

# CVE Replay Corpus

Each subdirectory is one captcha / WAF bypass disclosure that
captchaforge claims to handle. Tests assert captchaforge actually
solves the disclosed scenario — a regression here breaks the
disclosure-coverage contract.

## Layout

```
cve-corpus/
  CVE-YYYY-NNNNN/
    README.md          # disclosure summary + affected vendor + advisory link
    page.html          # frozen captured page for replay
    expected.json      # ExpectedOutcome the chain must produce
    solver.txt         # which captchaforge solver must win
```

The integration test `tests/cve_replay.rs` walks this directory and
asserts:

1. Every CVE has the required four files.
2. Detection on `page.html` returns the kind declared in
   `expected.json["kind"]`.
3. When the test environment has network + the relevant vendor key,
   the live solve produces `expected.json["outcome"] == "advanced"`.

## Adding a CVE

1. Get the public advisory + capture the offending page.
2. Run `python3 tools/pcap2fixture/convert.py --out-mode cve` (TODO).
3. Hand-write `expected.json` and `solver.txt`.
4. Commit. CI now replays it forever.

## Current status

Empty as of 0.2.31 — disclosures land incrementally. The directory
exists so `tests/cve_replay.rs` has a registry it can walk.