captchaforge 0.2.40

Captcha detection and solving for Firefox and BiDi-driven browsers. Detection, vendor solver scaffolding, trusted cross-origin click delivery into nested OOPIFs, and stealth personas are implemented and tested; broad live-vendor solve rates are not yet benchmarked.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

# CVE Replay Corpus

Each subdirectory is one captcha / WAF bypass disclosure that
captchaforge claims to handle. Tests assert captchaforge actually
solves the disclosed scenario, a regression here breaks the
disclosure-coverage contract.

## Layout

```
cve-corpus/
  CVE-YYYY-NNNNN/
    README.md          # disclosure summary + affected vendor + advisory link
    page.html          # frozen captured page for replay
    expected.json      # ExpectedOutcome the chain must produce
    solver.txt         # which captchaforge solver must win
```

The integration test `tests/cve_replay.rs` walks this directory and
asserts:

1. Every CVE has the required four files.
2. Detection on `page.html` returns the kind declared in
   `expected.json["kind"]`.
3. When the test environment has network + the relevant vendor key,
   the live solve produces `expected.json["outcome"] == "advanced"`.

## Adding a CVE

1. Get the public advisory + capture the offending page.
2. Run `python3 tools/pcap2fixture/convert.py --out-mode cve` (TODO).
3. Hand-write `expected.json` and `solver.txt`.
4. Commit. CI now replays it forever.

## Current status

Empty as of 0.2.31, disclosures land incrementally. The directory
exists so `tests/cve_replay.rs` has a registry it can walk.