← Commit history

2.1.1: avnet corrected - loads in pup on a paced single visit; the 20-tab batch tripped Akamai's velocity WAF (self-inflicted), clear cookies to recover

John Lauer ·efd4cd82ce ·22d ago ·parent f3ebb3d
1 file changed +14−15
gen.py+14−15
@@ -323,23 +323,22 @@ SITES = [   evidence="20-site fleet matrix 2026-09-14: loaded on all four boxes."),   dict(slug="avnet", name="Avnet", domains=["www.avnet.com"],-  what="Distributor. Product search, stock, design services.",-  defense="Akamai INTERACTIVE challenge ('Challenge Validation'). Denied on every box and egress 2026-09-14 - this is a human-click wall, not a silent block.",+  what="Distributor. Product search, stock, design services. Parent of Newark/element14.",+  defense="Akamai, with a VELOCITY-sensitive WAF rule. A normal single visit LOADS in pup (measured 6/6 on CfT 152, 2026-09-14, same box that nb loads it on). But a burst of requests (e.g. opening it as one of 20 tabs in a rapid batch) trips a WAF rule that serves 'Invalid URL / PR_WAF_DENY' with a reCAPTCHA, and that deny verdict STICKS in the cookie jar until cleared. So the block is self-inflicted by request velocity, not a hard browser wall.",   lanes={-   "WebFetch": ("BLOCKED", "challenge"),-   "curl": ("BLOCKED", "challenge"),-   "pup": ("BLOCKED", "'Challenge Validation' on every box and egress, 2026-09-14 - the interactive Akamai challenge, not a fingerprint issue"),-   "nb": ("PARTIAL", "the user can complete the challenge by hand in their real browser; hand it to them"),+   "WebFetch": ("untested", "assume the velocity rule applies"),+   "curl": ("untested", ""),+   "pup": ("OK", "loads on a normal single navigation (www.avnet.com/ and /americas/), CfT 152, 2026-09-14. A rapid multi-tab batch trips PR_WAF_DENY; clear cookies (pup_clear_cookies {domain:'avnet.com'}) and navigate once to recover"),+   "nb": ("OK", "loads (avnet.com/americas/)"),   },-  symptoms=["title 'Challenge Validation'", "an interactive Akamai challenge widget"],+  symptoms=["'Invalid URL' + PR_WAF_DENY + a reCAPTCHA widget + 'Reference #9.xxxxxxxx' - a WAF velocity deny, NOT the analog-style sensor deny", "the deny verdict persists across reloads until the jar is cleared"],   recipes=[-   ("Product data", "Do not fight the challenge in pup. Use Newark/element14 (avnet-owned, same catalog, no challenge) or adom-parts-search for numbers."),-   ("Must be avnet.com specifically", "nb, and hand the challenge to the user to click - this is nb's whole job for a human-gated wall."),+   ("Load avnet in pup", "Navigate to it ONCE (do not open it inside a rapid multi-tab burst). If it shows the WAF deny, pup_clear_cookies {domain:'avnet.com'} then navigate again. Both www.avnet.com/ and /americas/ load."),+   ("Product data", "Newark/element14 (avnet-owned, same catalog) or adom-parts-search for numbers, to avoid the velocity rule entirely."),   ],   api="Stock via adom-parts-search / the Newark catalog.",-  gotchas=["An interactive challenge is NOT the version/IP problem analog has - no browser change clears a human-click wall. Route to Newark or nb."],-  evidence="20-site fleet matrix 2026-09-14: denied on all four boxes with 'Challenge Validation'."),-+  gotchas=["This is a VELOCITY wall, not a fingerprint or IP wall: the same browser and IP load it on a paced single visit. My 2026-09-14 fleet matrix marked it BLOCKED because the matrix opens 20 tabs in a burst - that measured my own velocity, not the site. Pace multi-site opens, or clear the poisoned cookie."],+  evidence="2026-09-14: pup CfT 152 loaded avnet 6/6 on single navigations after a cookie clear, on the same AdomLapper/VPN egress where nb loads it; the earlier BLOCKED reading came from a 20-tab batch open tripping the WAF velocity rule."),  dict(slug="manufacturer", name="Other manufacturers (generic playbook)", domains=["www.nxp.com", "www.infineon.com", "www.renesas.com", "www.espressif.com", "www.newark.com (Farnell / Avnet)"],   what="The generic approach for a manufacturer or distributor site that does not have its own skill yet, plus lane-0 readings for a few we have only curl-tested.",   defense="Varies. Lane-0 readings 2026-09-12: infineon.com 200 (open), renesas.com 200 (Cloudflare, passes curl), espressif.com 200 (Apache, open), newark.com 200 (Akamai, passes curl), nxp.com 404 on /products/ (URL shape differs; product pages are /products/<family>/...:<PART>).",@@ -480,7 +479,7 @@ masks a fix. | Arrow | load | block | block | block | | Analog | load | block | block | load | | Datasheets | load | load | load | block |-| Avnet | interactive Akamai challenge (human click, nb's job) | | | |+| Avnet | loads on a paced single visit; the matrix's 20-tab BURST tripped Akamai's velocity WAF (self-inflicted). Clear cookies + navigate once. | | | |  *Mouser loads its home page but scores behaviour on crawls (DataDome) - use the API for data. @@ -640,7 +639,7 @@ def main():                {"label": "Which browser for DigiKey", "prompt": "which browser lane do I need to read a DigiKey product page"},                {"label": "Mouser 200 but denied", "prompt": "why does Mouser return HTTP 200 with access denied and what do I do"},                {"label": "Add a site", "prompt": "add an electronics-sites skill for nxp.com and verify its lanes"}]-    pkg = {"name": PACK, "slug": PACK, "version": "2.1.0", "type": "skill", "title": TITLE, "description": BRIEF,+    pkg = {"name": PACK, "slug": PACK, "version": "2.1.1", "type": "skill", "title": TITLE, "description": BRIEF,            "license": "MIT", "files": files, "scripts": {"install": "./install.sh", "uninstall": "./uninstall.sh"},            "dependencies": {}, "tags": TAGS, "keywords": TAGS, "discovery_triggers": TRIGGERS, "discovery_pitch": PITCH,            "sample_prompts": PROMPTS, "hero": {"path": "docs/hero.png"}}@@ -688,7 +687,7 @@ No captcha solving, no fingerprint spoofing: this pack routes around walls, it d """     write("README.md", readme)     page = json.load(open(os.path.join(ROOT, "page.json")))-    page.update({"slug": PACK, "version": "2.1.0", "title": TITLE, "brief": BRIEF, "readme": readme, "license": "MIT",+    page.update({"slug": PACK, "version": "2.1.1", "title": TITLE, "brief": BRIEF, "readme": readme, "license": "MIT",                  "tags": TAGS,                  "hero": {"type": "image", "path": "docs/hero.png"},                  "sample_prompts": PROMPTS, "discovery_triggers": TRIGGERS, "discovery_pitch": PITCH,