1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
# Prometheus alerting rules for captchaforge.
#
# Drop into your prometheus.yml rule_files: list. Pairs with the
# /metrics endpoint exposed by `captchaforge serve` — see
# README.md > Telemetry.
#
# Metric names (set by MetricsTelemetry):
# captchaforge_solve_total{solver,vendor,outcome} counter
# captchaforge_solve_duration_ms_bucket{...,le="..."} histogram
# captchaforge_solve_duration_ms_sum / _count histogram
#
# Tune `for:` durations to your traffic volume. Defaults assume the
# fleet receives at least 10 solves/minute steady-state.
groups:
- name: captchaforge.solver
interval: 30s
rules:
# Per-vendor success rate dropped below 70% over the last 10
# minutes. Likely causes: vendor rolled a new revision (CF), our
# stealth profile stale, or upstream WAF tuned harder.
- alert: CaptchaforgeVendorSuccessRateLow
expr: |
(
sum by (vendor) (rate(captchaforge_solve_total{outcome="success"}[10m]))
/
sum by (vendor) (rate(captchaforge_solve_total[10m]))
) < 0.70
for: 5m
labels:
severity: warning
component: captchaforge
annotations:
summary: "captchaforge: {{ $labels.vendor }} success rate < 70%"
description: |
Per-vendor solve success rate dropped to {{ $value | humanizePercentage }}
over the last 10 minutes. Investigate:
- vendor revision change (CF orchestrate hash)
- stealth profile drift (CreepJS / fp.json)
- upstream proxy health
Runbook: https://github.com/santhsecurity/captchaforge/blob/main/RUNBOOK.md#vendor-success-rate-low
# Critical: per-vendor success rate dropped below 30% — likely a
# full bypass-failure event. Page oncall.
- alert: CaptchaforgeVendorSuccessRateCritical
expr: |
(
sum by (vendor) (rate(captchaforge_solve_total{outcome="success"}[10m]))
/
sum by (vendor) (rate(captchaforge_solve_total[10m]))
) < 0.30
for: 3m
labels:
severity: critical
component: captchaforge
annotations:
summary: "captchaforge: {{ $labels.vendor }} success rate < 30% — BYPASS BROKEN"
description: |
Per-vendor solve success rate collapsed to {{ $value | humanizePercentage }}.
This is a full bypass-failure event. Likely cause: vendor pushed a fix.
# p95 solve duration > 30s. Either vendor's PoW got harder or the
# chain is bottlenecking on something slow.
- alert: CaptchaforgeSolveP95Slow
expr: |
histogram_quantile(0.95,
sum by (vendor, le) (rate(captchaforge_solve_duration_ms_bucket[10m]))
) > 30000
for: 10m
labels:
severity: warning
component: captchaforge
annotations:
summary: "captchaforge: p95 solve time > 30s for {{ $labels.vendor }}"
description: "p95 is {{ $value | humanizeDuration }}ms"
# Hard-block rate climbed above 5%. Either the deployment's IP is
# on a vendor's block list, or stealth is detected.
- alert: CaptchaforgeHardBlockRateHigh
expr: |
(
sum by (vendor) (rate(captchaforge_solve_total{outcome="hard_block"}[15m]))
/
sum by (vendor) (rate(captchaforge_solve_total[15m]))
) > 0.05
for: 10m
labels:
severity: warning
component: captchaforge
annotations:
summary: "captchaforge: {{ $labels.vendor }} hard-block rate > 5%"
description: |
Hard-block rate is {{ $value | humanizePercentage }} of attempts.
Suggests deployment IP / stealth fingerprint is flagged.
# Silent fail (solver claims success but oracle disagrees) > 10%.
# Means we're emitting tokens that don't actually verify upstream.
- alert: CaptchaforgeSilentFailRateHigh
expr: |
(
sum by (vendor) (rate(captchaforge_solve_total{outcome="silent_fail"}[15m]))
/
sum by (vendor) (rate(captchaforge_solve_total[15m]))
) > 0.10
for: 15m
labels:
severity: warning
component: captchaforge
annotations:
summary: "captchaforge: {{ $labels.vendor }} silent_fail > 10%"
description: |
Solvers are claiming success but the oracle disagrees — our
tokens look right but don't actually verify. Either oracle
is mis-classifying (Recycled / SilentFail false positive)
OR the solver path is broken.
- name: captchaforge.process
interval: 30s
rules:
# /serve process appears down — no metric data scraped.
- alert: CaptchaforgeServeDown
expr: up{job="captchaforge"} == 0
for: 2m
labels:
severity: critical
component: captchaforge
annotations:
summary: "captchaforge serve is down"
description: "Prometheus failed to scrape /metrics for 2 minutes."