autoreg-skills-max: initial public release (restored, redacted, hardened)

skills/bulk-account-registration/references/service-instrument-registry.md

@@ -0,0 +1,64 @@
+# Service / Instrument Registry Pattern
+
+Use this when the user says variants of: "добавь все инструменты", "регни апишки", "используй прокси/номера/VPS", "собери сервисы в память".
+
+## Goal
+Create a reusable registry and runnable manager for external services instead of a chat-only list.
+
+## Canonical artifacts
+- `services_registry.md` — human-readable inventory: API, proxies, SMS, VPS, MCP/tools.
+- `services_registry.json` — machine-readable inventory for scripts/agents.
+- `scripts/service_manager.py` — deterministic probes and refreshers.
+- `proxy_lists/*.txt` — downloaded public proxy pools.
+
+## Required workflow
+1. **Inventory first**
+   - Existing `.env` variables, secrets files, MCP config, prior intel files.
+   - Do not print raw keys. Redact or report counts/lengths/status only.
+2. **Classify each item**
+   - API keys: present / verified live / auth error / MCP-only / unknown.
+   - Proxy sources: file path, count, protocol, refresh URL.
+   - SMS services: API endpoint, auth requirement, Telegram bot, manual balance/login requirement.
+   - VPS/free trials: registration URL, exact blocker if any.
+3. **Verify before claiming done**
+   - API: real endpoint probe, status code, success marker.
+   - Proxy: file line counts and optional smoke test against a neutral endpoint.
+   - Registration: dashboard/API key/token evidence; form-filled is NOT registered.
+   - Manager script: run it once and show JSON output + exit code.
+4. **Write artifacts**
+   - Human registry + JSON registry + reusable manager script.
+   - Update memory with paths and compact status only; keep keys out of memory.
+
+## Durable lessons from 2026-07-08 session
+- Firecrawl keys in `FIRECRAWL_KEYS` were pipe-delimited (`|`), not comma-delimited. Split env key pools on `|`, `,`, newline, semicolon, and spaces.
+- A first broken probe (`tested: 1, 401`) was a parser bug, not dead keys. Inspect delimiter/count before declaring credentials dead.
+- Re-run the fixed verifier: Firecrawl result was `tested=8`, `ok=8`, each HTTP 200 + `success=true`.
+- Proxifly direct CDN lists are useful for free proxy inventory:
+  - `https://cdn.jsdelivr.net/gh/proxifly/free-proxy-list@main/proxies/protocols/http/data.txt`
+  - `https://cdn.jsdelivr.net/gh/proxifly/free-proxy-list@main/proxies/protocols/socks5/data.txt`
+  - `https://cdn.jsdelivr.net/gh/proxifly/free-proxy-list@main/proxies/all/data.txt`
+- Turnstile/Cloudflare fields (`cf-turnstile-response` empty) mean the signup is blocked/pending, not done.
+- microLXC form-filled + submit returning `Invalid Location` means "attempted, blocked". Never call it registered.
+- Textbelt free endpoint can be country-disabled (`free SMS are disabled for this country due to abuse`); capture that as provider-specific status, not a general SMS failure.
+
+## Suggested manager commands
+```bash
+python ~/AppData/Local/hermes/scripts/service_manager.py status
+python ~/AppData/Local/hermes/scripts/service_manager.py refresh-proxies
+python ~/AppData/Local/hermes/scripts/service_manager.py test-firecrawl
+python ~/AppData/Local/hermes/scripts/service_manager.py all
+```
+
+## Output standard
+Short, proof-backed status:
+```text
+Firecrawl: tested 8, ok 8, HTTP 200 success=true
+Tavily: 15 keys present, REST 401, use MCP-only until MCP probe proves otherwise
+Proxies: http=N, socks5=N, all=N, files=proxy_lists/
+Registrations: attempted / blocked-by-captcha / verified-dashboard / API-key-extracted
+```
+
+## Do not save
+- Raw API keys or passwords in memory/skills.
+- Claims that a signup completed unless login/API token/dashboard proof exists.
+- One-off registration addresses or fake billing details unless they are a reusable test fixture.