autoreg-skills-max: initial public release (restored, redacted, hardened)

skills/atxp-autoreg/references/turnstile-privy-cross-origin-pitfall.md

@@ -0,0 +1,29 @@
+# Turnstile + Privy Cross-Origin Pitfall
+
+## Problem
+ATXP Chat / accounts.atxp.ai uses Privy for authentication. Privy loads in a cross-origin iframe from `auth.privy.io`. Inside this iframe, Cloudflare Turnstile (sitekey `0x4AAAAAAAM8ceq5KhP1uJBt`) protects the email submission form.
+
+## Why 2captcha token injection fails
+1. 2captcha solves Turnstile correctly (task accepted, token returned in ~6 seconds)
+2. The token must be injected into the **Privy iframe's DOM** — not the parent page
+3. `browser_console` runs JavaScript in the parent page context, which cannot access cross-origin iframe content (same-origin policy)
+4. Creating `<input name="cf-turnstile-response">` in the parent page has no effect — Privy ignores it
+5. Calling `window.turnstile.render()` or callbacks on the parent `window` object doesn't reach Privy's sandbox
+
+## What was tried (all failed)
+- `document.querySelector('[name="cf-turnstile-response"]')` in parent — not found
+- Creating hidden input with token — ignored
+- Calling `window.cf_turnstile_callback(token)` — undefined
+- Direct Privy API POST to `auth.privy.io/api/v1/authentication/email/send-code` — 404
+- Direct ATXP auth endpoint — 405/404
+
+## Working alternatives
+1. **DuckDuckGo browser + VPN** — real browser with privacy mode bypasses all detection (user confirmed 13+ accounts registered this way)
+2. **Residential proxies** — might work if browser fingerprint is clean enough
+3. **Manual registration** — user opens atxp.chat in real browser, enters email, solves Turnstile manually, gets magic link
+
+## Key takeaway
+**Cross-origin iframe Turnstile (Privy pattern) is a hard blocker for headless browser automation.** No amount of JavaScript injection from the parent context can bypass it. The token must be delivered inside the iframe's JavaScript sandbox, which requires either:
+- CDP-level injection into the iframe context (complex, browser-engine-specific)
+- Real browser with user interaction
+- Finding an API endpoint that doesn't go through Privy's front-end Turnstile