autoreg-skills-max: initial public release (restored, redacted, hardened)

skills/account-validation/references/misskey-sharkey-signup-validation.md

@@ -0,0 +1,52 @@
+# Misskey/Sharkey Signup Validation and Anti-Abuse Boundary
+
+Use this when a task involves Misskey/Sharkey/Fediverse account inventories, OAuth login via a Misskey instance, or API-key extraction downstream of those accounts.
+
+## Durable validation lessons
+
+- Do **not** count a browser-flow registration as successful from page URL alone. Hash fragments such as `#mkmodal`, remaining on `#/signup`, or a page with no visible error can still mean the server rejected the signup.
+- Always verify created users server-side with the public API:
+  - `POST https://<instance>/api/users/show`
+  - body: `{ "username": "<name>" }`
+  - existing account: JSON with an `id`
+  - fake/non-created account: 404 / `NO_SUCH_USER`
+- Check instance configuration before attempting any signup/login flow:
+  - `POST https://<instance>/api/meta` with `{ "detail": true }`
+  - inspect `disableRegistration`, `emailRequiredForSignup`, `enableTurnstile`, `turnstileSiteKey`, `enableRecaptcha`, `enableHcaptcha`, `enableMcaptcha`
+- Misskey/Sharkey OAuth/MiAuth URLs may include the relying-party domain inside a `callback=` parameter. Do not treat `"j3gb.com" in current_url` as proof that the browser is on j3gb; parse the hostname and ensure the URL is not still `/<instance>/miauth/...`.
+- If the page is still on `/miauth/...` and shows "Select an account" / "Выберите учётную запись", the OAuth authorization is not complete. A valid local account must be selected and the continue/authorize button clicked before any relying-party API key can appear.
+
+## Captcha / Turnstile reality checks
+
+- Misskey/Sharkey signup can enforce captcha at the API layer. A direct `POST /api/signup` without the captcha response may return a clear error such as `CaptchaError: turnstile-failed: no response provided`.
+- Capture the requirement from `/api/meta`; do not hard-code that a given instance is captcha-free or captcha-protected forever.
+- Do not persist environment-specific claims like "CDP/Browserbase/Patchright does not work" as a rule. Treat those as session observations only. The durable rule is: verify through server APIs, and if captcha is enabled, use authorized/manual/official paths rather than assuming browser automation succeeded.
+
+## Boundary
+
+Do not assist with mass creation of Misskey/Sharkey accounts, captcha-bypass/solver integration, stealth browser tuning, proxy rotation, or OAuth flows whose purpose is farming downstream API keys, credits, promos, or referral benefits. Stop before running or patching signup scripts. Safe pivots:
+
+- Validate whether provided accounts actually exist via `POST /api/users/show`.
+- Help the user configure or test one account they own.
+- Build a key manager/test harness for legitimate API keys already provided by the user.
+- Explain how to complete the official manual OAuth flow without bypassing captcha or anti-abuse controls.
+
+## Minimal verification snippet
+
+```python
+import json, urllib.request
+
+instance = "dc.hhhl.cc"
+username = "example_user"
+req = urllib.request.Request(
+    f"https://{instance}/api/users/show",
+    data=json.dumps({"username": username}).encode(),
+    headers={"Content-Type": "application/json", "User-Agent": "Mozilla/5.0"},
+)
+try:
+    with urllib.request.urlopen(req, timeout=15) as r:
+        user = json.loads(r.read())
+    print("exists", user.get("id"))
+except urllib.error.HTTPError as e:
+    print("not verified", e.code, e.read().decode()[:200])
+```