Skarbiec#

Exact consumer|item|field scopes supply approved credentials. Literal type_text, fill and set_control inspect the actual field and refuse credential edits; selectors do not bypass this check.

Generic tasks seed the executor's action history with completed navigation and prefills, retain those receipts as initialization_history, and remove consumed capabilities from available inputs. Prefilled runs never reuse or save a flow cache. Deferred, absent fields keep their unspent capabilities; an invented account is never a substitute.

Stado#

Stado places and operates the approved host and verifies browser release coordinates. Synchronous reauthentication uses the same trajectory as queued work. The Weles package includes its recording executable rather than relying on an evictable host cache; weles doctor reports the expected recording component and whether it is present, and successful browser execution proves that it actually works.

Jeden#

macOS workers carry the signed jeden and jeden-sandbox-helper together under native/jeden/bin/; Linux worker archives carry their native CLI. Both publishers use release/native/runtime.mjs and the URI and SHA-256 pins in .wisent-release.json. Missing, non-executable or incorrectly hashed inputs are refused. No host installation or inherited WELES_JEDEN_BIN replaces this runtime.

Native tasks read their own screenshot or frame directory through Jeden's --cwd, without write or command grants. An unanswered page question stops live execution and cached replay with its cause. Successful caches use weles.successful-flow.v1; earlier caches are rediscovered because they could contain failed reads. generic_keeper_task always observes the current page instead of replaying a saved result.

Startup runs each required binary with --version before acquiring credentials or starting the API. A refusal names the binary, operation and observed error, including exit status and signal. Stado's release launcher derives missing or non-executable cached files again from its payload and refuses an incomplete payload. Page reading and diagnosis use these binaries; model-only calls stay on Brama. Runtime files live under $HOME/.stado/var/weles/runtime/<payload-sha256>, outside Stado's immutable installation.

Mobile egress managed by Stado#

Weles may use a phone's mobile connection as its browser exit. Stado owns the long-running proxy; Weles owns proxy selection, target policy and browser execution. USB tethering is preferable to Wi-Fi tethering for stability. Use the approved host's real interface and installed Stado executable: INTERFACE is that interface's name, PROXY_PORT the port the deployment chose for the proxy, HEADER_BYTES the deployment's positive whole-byte request-header budget, and PROXY_URL the proxy's own loopback address that stado egress mobile serve reports. Stado refuses an undeclared budget before listening; the bound includes the terminating blank line but not forwarded bodies or tunnel payloads. Stado's configuration page (stado.wisent.com/docs/configuration) covers the refusals, service logs and the real qualification command.

No interface or port is a default. The proxy binds upstream connections to that interface and refuses non-loopback listeners or an unusable IPv4 interface. Browser and proxy run on the same host. Trajectories pass the same PROXY_URL as proxy to WSession.start; the CLI uses --proxy. Normal Stado commands own later status, logs and service lifecycle.

Mobile exits may match a site's expected identity but can be slower, unstable or behind carrier NAT. Residential and datacenter exits fit different workloads, and the type alone proves no quality: check IP, ASN, geography, proxy classification, DNS and WebRTC behaviour, latency and target response. Stado's real-device egress tests require a trusted phone and observed mobile IP classification; disconnected hardware or an unclassified exit is not a passing result.

Shell

networksetup -listallhardwareports
stado egress mobile serve --interface "$INTERFACE" --port "$PROXY_PORT" --max-header-bytes "$HEADER_BYTES"
stado service ensure weles-mobile-egress \
  --host <weles-host> --from /Users/<service-account>/.stado/bin/stado \
  --arg egress --arg mobile --arg serve --arg=--interface --arg "$INTERFACE" \
  --arg=--port --arg "$PROXY_PORT" --arg=--max-header-bytes --arg "$HEADER_BYTES" \
  --reason "Weles mobile egress"
stado service status weles-mobile-egress

Accounts Weles registers#

Every registration (the shared identity generator, Pangram, SadCaptcha, 2Captcha) takes its password from one generator: one character of each class sign-up forms check (upper, lower, digit, special), the rest from all of them, shuffled, at the length the vault's policy states. Set it once with skarbiec policy set min_generated_length <length>; with none set, a registration is refused naming that command, and a length shorter than the four classes is refused too. node tests/identity/password.mjs checks this against an isolated vault made with skarbiec init.

A registration takes its inbox domain from FORCE_EMAIL_DOMAIN when set. Otherwise it takes the least-used active domain among the recorded inbound domains (the Weles setting inbound_email_domains) whose MX resolves and that the platform has not blocked. With none recorded, it takes one of the domains listed in AGENT_EMAIL_DOMAINS, or AGENT_DOMAIN. With none of these, the registration is refused naming them; no domain is assumed.

A recorded domain whose MX lookup fails is marked mx_broken, with the resolver's cause logged, until a later pick finds its MX again. A stored inbound_email_domains value that is not a list is refused with what it holds.

Design exports for wisent-components#

weles design export --provider figma --request <export-request.json> reads the Figma files the request's inventory names, with the Figma token Skarbiec holds for the export workload, and publishes them into an existing Git checkout: it replaces one directory, commits only that directory and pushes it to the request's remote and branch.

That directory is the request's output, relative to the checkout; without it, figma. wisent-components keeps each design library in libraries/<name>/, so the request for a library names "output": "libraries/<name>/figma", and the directory is created on its first export.

The export refuses an output that is absolute, outside the checkout, the checkout itself or inside .git; a request, inventory, scope file or signing key inside that directory; an existing directory with no export inventory; ignored files inside it; a dirty checkout, another branch, or a branch that has diverged from its remote. node tests/design/export-output.mjs in the weles repository runs request reading and publication against a real local repository and its remote.