Three different labels#

Layer	Values	What it means
`Requested route type`	isp \| residential \| mobile	What the trajectory asks the router to supply. This comes from task policy or an approved override; it is a requirement, not proof of the exit received.
`WHOIS class`	residential \| datacenter \| unknown	What src/proxy/quality/classify.ts infers from the exit IP's organization and netname using maintained organization lists.
`Reputation result`	clean \| proxy \| hosting \| mobile \| unknown	What src/proxy/policy.ts derives from ip-api proxy, hosting, and mobile flags while retaining country, timezone, ISP, organization, ASN, and reverse DNS as evidence.

Why choose each route#

Route	Use it when	Tradeoff
`Datacenter`	The target permits automation, the work is public or stateless, account reputation is irrelevant, and low cost, bandwidth, and stable infrastructure matter most.	Usually cheapest and fastest, but hosting ASNs are easy to identify. The basic registration preflight rejects a detected datacenter exit.
`Residential`	The target evaluates consumer-network reputation, or discovery and registration need an ordinary household ISP exit. Use a sticky identity when one session must keep the same IP.	Better consumer-network resemblance, but rotating pools can change country or IP, inherit another customer's burn history, and break account-to-IP continuity.
`ISP / static residential`	A long-lived account must return through one stable, consumer-looking network identity across login, challenge, health, and later actions.	The preferred account-bound route in current task policy. More expensive and scarce; an ISP-branded pool can still terminate on a datacenter ASN, so the actual exit must be checked.
`Mobile`	The product is mobile-first, the platform expects carrier traffic, or a reviewed comparison needs a cellular-network counterfactual.	Carrier ASN and CGNAT can provide strong consumer provenance, but exits rotate, geolocation is coarse, latency and cost are higher, and shared carrier addresses can already be challenged.
`Direct`	The platform accepts worker egress and the action does not need a separate account-bound network identity.	Simplest path with no proxy failure mode, but it exposes the worker's own network identity and must not be substituted for a required proxy.

Current policy#

taskNetworkRequirements(action, platform) is the central declared policy. It chooses direct egress for GitHub, Product Hunt, and Pangram; other account-bound platforms currently request an ISP route, normally in the US. A trajectory must not silently fall back to another type.

Provider capability is tracked separately by provider and action. Known failures can exclude a provider, pause a platform when none works, and prefer an exact prior pass before a same-platform pass or an untried provider; price breaks ties inside the same evidence tier.

Basic datacenter check#

preflightProxy(proxyUrl) in src/proxy/quality/preflight.ts is the available reusable basic check. It asks api.ipify.org for one external IPv4 address through the proxy, classifies that IP from WHOIS, and returns { ok, ip, classification?, error? }. classification contains ip, quality, org, netname, source, and the matched organization term when one exists.

The basic rule rejects datacenter and accepts residential or unknown. Unknown is not a high-quality verdict: it means the maintained WHOIS lists could not classify the network. This check has no numeric score, supports IPv4 only, caches by IP, and does not by itself prove country, stickiness, browser routing, WebRTC safety, or platform acceptance.

TypeScript

import { preflightProxy, summarizePreflight } from './dist/proxy/quality/preflight.js';

const result = await preflightProxy(process.env.PROXY_URL);
console.log(summarizePreflight(result));
// preflight ACCEPT|REJECT ip=<exit> quality=residential|datacenter|unknown org="..."

Reputation, geography, and network history#

Function or state	Answers
`verifyExitReputation(exitIp)`	Whether ip-api marks the exit clean, proxy, hosting, mobile, or unknown; also returns country, region, city, timezone, ISP, organization, ASN, and reverse DNS.
`verifyExitCountry(exitIp, expectedCc)`	Whether the observed exit country matches the requested country: match, mismatch, or unknown.
`allBurnKeys(exitIp)`	The exact IP, /24, /19, and optional ASN keys used to join failures across related exits.
`probeLedgerStats()`	Observed clean/challenge rate overall, over seven days, and per /19 network when a probe ledger exists.
`isBurned / markBurned`	Whether an endpoint has known failure history and the signal/platform that marked it.
`resolveProxy(...)`	Provider selection, sticky identity, endpoint attempts, country/reputation/platform probes, and the final routed proxy used by a session.

What low quality means#

Weles does not currently reduce quality to one number. An exit is unsuitable when it violates the requested route, is classified as datacenter for a sensitive account flow, is flagged proxy or hosting by reputation data, has the wrong country, changes during a sticky session, differs between node and browser, leaks a direct address through WebRTC or IPv6, appears in burn history, or reaches a platform challenge where a controlled comparison reaches the intended form.

A failed website run alone is not a proxy-quality result. Burn attribution needs controlled runs that retain the proxy identity, browser/persona, challenge outcome, and terminal signal so a trajectory or fingerprint defect is not mislabeled as a bad IP.

Specialist audits and current limitation#

scripts/debug/proxy_quality_audit.mjs, browser_proxy_leak_audit.mjs, and linkedin_dedicated_proxy_readiness_audit.mjs model the richer checks: direct-versus-proxy exit, browser routing, IPv4/IPv6 and WebRTC leaks, dedicated/static declaration, and platform-specific readiness.

These scripts are diagnostic source, not a supported public command. In the current checkout they import dist/proxy/quality.js while the corresponding src/proxy/quality.ts source file is absent; therefore this documentation does not present them as a reproducible public entrypoint. There is currently no weles proxy check command.