
Research notes and offline verification tooling for Cloudflare Turnstile, covering the 2-POST chain, per-fetch build pool, capture protocol, and FO1 bag-binding.
Historical research code and technical notes. Live launchers are disabled. The capture extension records metadata from local fixtures only.
FO1 HTTP 400 remains unresolved. Private captures, credentials, the verdict ledger, protected corpus and W15 rig are not included. Historical results cannot be reproduced from this export alone.
Requires Python 3.11+ and Node.js 22+, with no third-party libraries:
python -X utf8 tools/verify_repo.py
Results stay in .local/verification/. Missing historical evidence is reported as
SKIP; python -X utf8 tools/xcheck.py --strict-evidence treats it as failure.
Passing these tests does not establish server acceptance.
See engine usage, instrumentation and open questions. The VM is not a security sandbox; use trusted local fixtures only.