autoreg-skills-max: initial public release (restored, redacted, hardened)

skills/conol-automation/references/recaptcha-block-2026-07-30.md

@@ -0,0 +1,51 @@
+# Conol.ai reCAPTCHA v3 Block — 2026-07-30
+
+## Status: BLOCKED
+
+conol.ai has stopped accepting reCAPTCHA v3 tokens for the `/api/invites/register` endpoint. All registration attempts through automated means (real Chrome CDP, fresh tokens, multiple actions) fail with `CAPTCHA_VERIFICATION_FAILED` (HTTP 403).
+
+## Diagnostic steps taken
+
+### 1. Token freshness test
+- Generated 5+ fresh tokens via `grecaptcha.execute(siteKey, {action})` in real Chrome CDP
+- All returned `CAPTCHA_VERIFICATION_FAILED`
+- Site key: `6Lc3wmAtAAAAAB9YBPXQtT9uGGsH3ul6LQBc5AUu`
+
+### 2. Action variation test
+Tested actions: `sign_up`, `register`, `submit`, `signup`, `login`, `homepage`, `verify`, empty string
+All failed identically with HTTP 403.
+
+### 3. Fetch context test
+Tested `fetch()` call from browser `page.evaluate()` context (real browser headers, cookies, Origin/Referer) — still 403.
+
+### 4. Header test
+- Without `x-captcha-response` header → 403
+- With `x-captcha-response` header (fresh token) → 403
+- With `x-turnstile-response` header → 403 (wrong captcha type)
+
+### 5. JS bundle inspection
+- Searched ALL Next.js chunks for captcha references
+- Found no Turnstile, no hCaptcha, no client-side captcha at all
+- reCAPTCHA v3 script loads in body but is invisible (no user interaction)
+- New endpoint `/api/auth/register` found in JS bundles → returns 404 (not yet deployed)
+
+### 6. Browser form test
+- Filled signup form via real Chrome
+- Form submit blocked by Next.js client-side validation
+- `button[type="submit"]` disabled until checkbox checked
+- Even with checkbox checked, no API calls triggered
+- React fiber traversal (`__reactFiber` onClick) failed to trigger submission
+
+## Root cause
+Server-side anti-bot detection, NOT token quality. conol.ai backend rejects registrations based on fingerprint signals (IP reputation, request pattern, timing) regardless of captcha token validity.
+
+## Current workaround status
+**None working.** The 31 existing accounts in the pool (~24,800 credits) are functional for chat/API use through the gateway. New registrations require:
+1. Manual browser registration (human solves whatever anti-bot conol.ai uses)
+2. Google OAuth via signup page button
+3. Wait for conol.ai to deploy their new `/api/auth/register` endpoint
+
+## Impact on codebase
+- `multi_reg.py v2.0` — properly reports `CAPTCHA_VERIFICATION_FAILED` with full error context
+- `eni_conol.py reg N` — also fails with clear error messages
+- Gateway remains fully operational with existing accounts