captchaforge 0.2.39

Captcha detection and solving for Firefox and BiDi-driven browsers. Detection, vendor solver scaffolding, trusted cross-origin click delivery into nested OOPIFs, and stealth personas are implemented and tested; broad live-vendor solve rates are not yet benchmarked.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131

# Prometheus alerting rules for captchaforge.
#
# Drop into your prometheus.yml rule_files: list. Pairs with the
# /metrics endpoint exposed by `captchaforge serve`: see
# README.md > Telemetry.
#
# Metric names (set by MetricsTelemetry):
#   captchaforge_solve_total{solver,vendor,outcome}      counter
#   captchaforge_solve_duration_ms_bucket{...,le="..."}  histogram
#   captchaforge_solve_duration_ms_sum / _count          histogram
#
# Tune `for:` durations to your traffic volume. Defaults assume the
# fleet receives at least 10 solves/minute steady-state.

groups:
- name: captchaforge.solver
  interval: 30s
  rules:

  # Per-vendor success rate dropped below 70% over the last 10
  # minutes. Likely causes: vendor rolled a new revision (CF), our
  # stealth profile stale, or upstream WAF tuned harder.
  - alert: CaptchaforgeVendorSuccessRateLow
    expr: |
      (
        sum by (vendor) (rate(captchaforge_solve_total{outcome="success"}[10m]))
        /
        sum by (vendor) (rate(captchaforge_solve_total[10m]))
      ) < 0.70
    for: 5m
    labels:
      severity: warning
      component: captchaforge
    annotations:
      summary: "captchaforge: {{ $labels.vendor }} success rate < 70%"
      description: |
        Per-vendor solve success rate dropped to {{ $value | humanizePercentage }}
        over the last 10 minutes. Investigate:
          - vendor revision change (CF orchestrate hash)
          - stealth profile drift (CreepJS / fp.json)
          - upstream proxy health
        Runbook: https://github.com/santhreal/captchaforge/blob/main/RUNBOOK.md#vendor-success-rate-low

  # Critical: per-vendor success rate dropped below 30%, likely a
  # full bypass-failure event. Page oncall.
  - alert: CaptchaforgeVendorSuccessRateCritical
    expr: |
      (
        sum by (vendor) (rate(captchaforge_solve_total{outcome="success"}[10m]))
        /
        sum by (vendor) (rate(captchaforge_solve_total[10m]))
      ) < 0.30
    for: 3m
    labels:
      severity: critical
      component: captchaforge
    annotations:
      summary: "captchaforge: {{ $labels.vendor }} success rate < 30%. BYPASS BROKEN"
      description: |
        Per-vendor solve success rate collapsed to {{ $value | humanizePercentage }}.
        This is a full bypass-failure event. Likely cause: vendor pushed a fix.

  # p95 solve duration > 30s. Either vendor's PoW got harder or the
  # chain is bottlenecking on something slow.
  - alert: CaptchaforgeSolveP95Slow
    expr: |
      histogram_quantile(0.95,
        sum by (vendor, le) (rate(captchaforge_solve_duration_ms_bucket[10m]))
      ) > 30000
    for: 10m
    labels:
      severity: warning
      component: captchaforge
    annotations:
      summary: "captchaforge: p95 solve time > 30s for {{ $labels.vendor }}"
      description: "p95 is {{ $value | humanizeDuration }}ms"

  # Hard-block rate climbed above 5%. Either the deployment's IP is
  # on a vendor's block list, or stealth is detected.
  - alert: CaptchaforgeHardBlockRateHigh
    expr: |
      (
        sum by (vendor) (rate(captchaforge_solve_total{outcome="hard_block"}[15m]))
        /
        sum by (vendor) (rate(captchaforge_solve_total[15m]))
      ) > 0.05
    for: 10m
    labels:
      severity: warning
      component: captchaforge
    annotations:
      summary: "captchaforge: {{ $labels.vendor }} hard-block rate > 5%"
      description: |
        Hard-block rate is {{ $value | humanizePercentage }} of attempts.
        Suggests deployment IP / stealth fingerprint is flagged.

  # Silent fail (solver claims success but oracle disagrees) > 10%.
  # Means we're emitting tokens that don't actually verify upstream.
  - alert: CaptchaforgeSilentFailRateHigh
    expr: |
      (
        sum by (vendor) (rate(captchaforge_solve_total{outcome="silent_fail"}[15m]))
        /
        sum by (vendor) (rate(captchaforge_solve_total[15m]))
      ) > 0.10
    for: 15m
    labels:
      severity: warning
      component: captchaforge
    annotations:
      summary: "captchaforge: {{ $labels.vendor }} silent_fail > 10%"
      description: |
        Solvers are claiming success but the oracle disagrees, our
        tokens look right but don't actually verify. Either oracle
        is mis-classifying (Recycled / SilentFail false positive)
        OR the solver path is broken.

- name: captchaforge.process
  interval: 30s
  rules:

  # /serve process appears down (no metric data scraped).
  - alert: CaptchaforgeServeDown
    expr: up{job="captchaforge"} == 0
    for: 2m
    labels:
      severity: critical
      component: captchaforge
    annotations:
      summary: "captchaforge serve is down"
      description: "Prometheus failed to scrape /metrics for 2 minutes."