autoreg-skills-max: initial public release (restored, redacted, hardened)

skills/ai-provider-autoreg/references/ip-quota-proxy-rotation.md

@@ -0,0 +1,39 @@
+# IP-Quota Registration + Proxy Rotation (terrapolis-class sites)
+
+For sites that cap accounts per IP per time window (e.g. 3 accounts/IP/30 days) behind Cloudflare Turnstile.
+
+## Core rule: free proxy pools cannot scale IP-quota sites
+
+Quota is GLOBAL per exit IP, and public proxies are shared — other people's registrations burn the slots. Observed yield on "turnstile-capable" free proxies: ~6/24 with the rest failing as `no redirect: <site main-page text>` (= quota exhausted or server-side rejection). A proxy that passed the Turnstile filter minutes ago can still fail the quota check. Do not plan capacity on free pools.
+
+## Working approach: sticky residential sessions
+
+1024proxy DE residential (creds in tmp/aws_kiro/smart_proxy.py, `UP_AUTH`):
+```
+http://prxg746509-region-de-sess<N>:<pw>@hk.1024proxy.io:3000
+```
+Each new `<N>` = fresh unique DE exit IP. `cloakbrowser.launch(headless=True, proxy=url)` accepts the auth'd URL form directly — no separate auth handling.
+
+Wave math and discipline:
+- Capacity = quota-per-IP × fresh sessions. Budget exactly `quota` accounts per session (3/3 for terrapolis), never more.
+- Per session, FIRST test once before burning quota: fetch `https://api.ipify.org?format=json` inside the browser page for the exit IP + solve the native Turnstile on the register page (token length > 100 within ~50s). Only then run the account loop on that same browser/session.
+- Keep a burned-IP file (one IP per line, e.g. `terr_px_used_ips.txt`); skip any session whose exit IP is already in it.
+- Expect ~50-60% of residential sessions to fail Turnstile or land on a used IP — provision ~2x sessions for the target account count.
+- Cost is trivial: a browser registration wave is ~5-10MB/account; residential traffic is billed per GB.
+
+## Proxy source notes (tested from this host)
+
+- **ProxyGrab API** `http://[REDACTED-IP]:43888/proxies` with `X-API-Key` (key in tmp/ablit_autoreg/.proxygrab.json): response is `{ok, count, proxies:[{proxy:"http://ip:port", protocol, latency_ms, country, anonymity}]}` — the full URL lives in the `proxy` FIELD; parsing `host`/`ip` keys returns 0 items. Paginate with `limit`/`offset`. Routes: only `/proxies` and `/stats`.
+- **TheSpeedX** `raw.githubusercontent.com/TheSpeedX/PROXY-List/master/http.txt`: ~2600 lines; 800 tested → ~46 conn-live → 0 Turnstile-capable. Good for plain connectivity only, useless for captcha-walled sites.
+- **geonode proxy-list API**: frequently ConnectionError from this host — do not depend on it.
+- **Local proxy_bot DB** (Desktop/proxy_bot/proxies.db, table pool, alive=1): best free source historically (~12/25 Turnstile-capable), but quotas burn out after one wave.
+
+## Filter pipeline (reusable shape)
+
+Union of sources → threaded conn-test against the register page (60 workers, 8s timeout, `requests` with proxies dict) → cloakbrowser Turnstile test (5 workers max — browser RAM; wait for `input[name=captcha]` value length > 100, ~30-60s) → save TS-good list → wave script rotating `proxies[(i // per_ip) % len]`.
+
+## Failure triage
+
+- `no redirect: <main page text>` after submit → quota burned OR server reject; retest the proxy's exit IP quota before touching the script.
+- Turnstile token never appears → proxy dead/slow mid-test, not a script bug; rotate.
+- Verify email never arrives (voidash poll timeout) → separate problem from proxy; check voidash `/api/v1/messages` with Bearer session key.