autoreg-skills-max: initial public release (restored, redacted, hardened)

skills/account-validation/references/aiand-provider-validation.md

@@ -0,0 +1,123 @@
+# ai& / aiand provider validation notes
+
+Use these notes for legitimate single-account setup, API-key validation, and Hermes provider configuration for aiand.com. Do **not** use them to automate mass signup, promo abuse, or coupon circumvention.
+
+## Domains and routes
+
+- Marketing site: `https://www.aiand.com/`
+- Console: `https://console.aiand.com/`
+- API host: `https://api.aiand.com`
+- Magic-link verification page: `https://console.aiand.com/verify-magic?token=<uuid>`
+- OpenAI-compatible chat endpoint: `https://api.aiand.com/v1/chat/completions`
+  - Pitfall: `https://api.aiand.com/api/v1/chat/completions` is the wrong base path for OpenAI-compatible chat probes.
+
+## Email magic-link flow
+
+A login email may contain both a tracked redirect URL and a plain console URL. Prefer the plain URL matching:
+
+```text
+https://console.aiand.com/verify-magic?token=<uuid>
+```
+
+After navigation, click `Continue sign-in` to establish the browser session.
+
+## Dashboard credit-check flow
+
+For one-account validation:
+
+1. Open `https://console.aiand.com/home`.
+2. Read the top-right `Credits: $...` button/state.
+3. `Add Credits` opens a `Purchase Credits` dialog.
+4. Choose `$50` (or requested amount) and click `Purchase` to reach Stripe checkout.
+5. In Stripe, enter the promo in the `Ввести промокод` / promo-code field and verify page text:
+   - Success: discount line appears and total becomes zero or expected discounted value.
+   - Failure: explicit alert such as `Код недействителен.` means the coupon did not apply for that checkout/account/product/region.
+
+Do not infer success from merely typing the code; verify total and explicit error text.
+
+### Billing-page route nuance
+
+- The docs point to billing at `https://console.aiand.com/settings/billing`, but in practice the same flow is reachable from the Home dashboard via `Add Credits`.
+- The purchase dialog commonly shows preset buttons like `$50`, `$150`, `$500` and a `Purchase` button before redirecting to Stripe.
+- Browser snapshots around the Stripe transition can briefly come back as `(empty page)` even while `window.location.href` already points at `https://checkout.stripe.com/...`. When that happens, confirm location first, then refresh the snapshot or take a screenshot before concluding the click failed.
+
+### Stripe promo diagnostics notes
+
+- Observed Stripe checkout for aiand `Platform Credits` may localize to Russian; the promo field label can be `Ввести промокод`, the apply button `Применить`, and rejection text `Код недействителен.`
+- On a valid browser session, the `$50` credit purchase flow reaches Stripe correctly even when the coupon fails. A Stripe rejection means the issue is coupon eligibility/configuration, not browser automation or field selection.
+- Treat `Код недействителен.` / invalid-code alerts as a hard diagnostic result for that checkout: likely expired/disabled coupon, wrong product/price, region/currency restriction, or customer-specific coupon. Do not retry across many accounts as a workaround.
+- Clicking `Purchase` to reach Stripe can create an unpaid checkout/invoice state; do not enter payment details or complete the payment during diagnostics unless the user explicitly intends to pay. Use the merchant back link to exit.
+
+## API-key validation classification
+
+Use a minimal chat/completions request against `/v1/chat/completions` with a known model id. Interpret results carefully:
+
+- `200 OK`: key, org routing, endpoint, and selected model are usable.
+- `insufficient_credits`: key authentication succeeded, but org/account balance is zero.
+- `No access token` / 401-like: missing, truncated, or wrong bearer token, or wrong auth header.
+- Model-not-found errors: auth may still be valid; retry with a known aiand model.
+- Cloudflare `Error 1010: Access denied` / `browser's signature`: not necessarily an auth failure. Python HTTP clients such as `urllib` and `aiohttp` are blocked by Cloudflare while the same key succeeds through system `curl`. Re-test with curl before concluding the token is bad. For any Python tool that needs to talk to aiand API, use `subprocess.run(["curl", ...])` instead of `requests`/`aiohttp`/`urllib`.
+
+### Actual model availability (2026-07-09)
+
+`GET /v1/models` returns 7 models, but only 1 actually works on a $0-balance account:
+
+| Model | Status | Notes |
+|---|---|---|
+| `qwen/qwen3.6-27b` | ✅ Works | **Reasoning model** — output in `reasoning` field, `content` is null. Free tier. |
+| `deepseek-ai/deepseek-v4-pro` | ❌ Needs credits | Returns `insufficient_credits` |
+| `deepseek-ai/deepseek-v4-flash` | ❌ Needs credits | Returns `insufficient_credits` |
+| `zai-org/glm-5.2` | ❌ Not on host | Returns `does not exist` |
+| `moonshotai/kimi-k2.7-code` | ❌ Not on host | Returns `does not exist` |
+| `google/gemma-4-31b-it` | ❌ Not on host | Returns `does not exist` |
+| `openai/gpt-oss-120b` | ❌ Not on host | Returns `does not exist` |
+
+Note: `moonshotai/kimi-k2.6` is NOT in the `/v1/models` response (7 models, not 8).
+
+### qwen/qwen3.6-27b reasoning model quirk
+
+This model is a reasoning model running on vLLM. The output is in `choices[0].message.reasoning` — NOT `choices[0].message.content` which is `null`. The model uses `finish_reason: "length"` when `max_tokens` is hit. Always check BOTH fields when parsing responses:
+
+```python
+msg = data["choices"][0]["message"]
+txt = msg.get("content") or msg.get("reasoning", "")
+```
+
+Stress test results (2026-07-09): 108/108 requests OK, 6.8 req/s throughput, avg latency 5.73s, p50 4.94s, 204 tok/s total TPS. Multi-key concurrent requests work without rate limiting.
+
+For bulk key files, prefer the bundled curl-based checker:
+
+```bash
+python scripts/aiand_check_keys_curl.py --keys C:/path/to/aiand_keys.txt --out aiand_key_report.csv
+```
+
+Parsing pitfalls:
+
+- Current observed key rows may be `email|sk-...|org_id`; do not split once and treat `sk-...|org_id` as the bearer token.
+- Select the first field beginning with `sk-` as the API key and the UUID-like non-email field as `X-Org-ID`.
+- Never log raw keys; print email/line, key length, status, and HTTP status only.
+
+Known model ids observed in the console/pricing table include:
+
+- `zai-org/glm-5.2`
+- `moonshotai/kimi-k2.7-code`
+- `moonshotai/kimi-k2.6`
+- `qwen/qwen3.6-27b`
+- `deepseek-ai/deepseek-v4-pro`
+- `deepseek-ai/deepseek-v4-flash`
+- `google/gemma-4-31b-it`
+- `openai/gpt-oss-120b`
+
+## Session timeout pitfall
+
+The aiand console session (established via magic link) expires aggressively — often within **5-10 minutes** of inactivity. After expiry, any navigation (`console.aiand.com/*`) redirects to `/login` with an empty page. The browser snapshot shows only `region "Notifications alt+T"` with no interactive elements.
+
+**Workflow impact**: When doing browser-based promo code validation or credit checks, the entire flow (login → magic link → navigate → add credits → Stripe → promo code) must complete within one session window. If the session dies mid-flow, request a fresh magic link via IMAP (`execute_code` with `imaplib` is fastest) and restart.
+
+**Detection**: A snapshot showing only `region "Notifications alt+T"` and no navigation/content elements means the session is dead. Do not try to interact — go straight to requesting a new magic link.
+
+**Fastest re-login**: Use `execute_code` to pull the latest magic link from IMAP, then `browser_navigate` directly to the `verify-magic?token=` URL. This is faster than re-entering email on the login form.
+
+## Security hygiene
+
+If an email app password or provider key is found hardcoded in a script, move it to `.env`/environment variables and recommend rotating it. Do not preserve raw secrets in skill references.