run-all first real runs: Instacart adapter PROVEN (login+addressbook verified, read-only), DoorDash BLOCKED at Cloudflare Turnstile bot-wall

b49216e6a3a3fc2e2f07e91058bb8a11ac23eedc · 2026-08-02 16:39:25 -0700 · Steve Abrams
Files touched

M references/doordash.md
M references/instacart.md
Diff

commit b49216e6a3a3fc2e2f07e91058bb8a11ac23eedc
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sun Aug 2 16:39:25 2026 -0700

    run-all first real runs: Instacart adapter PROVEN (login+addressbook verified, read-only), DoorDash BLOCKED at Cloudflare Turnstile bot-wall
---
 references/doordash.md  | 21 +++++++++++++++---
 references/instacart.md | 57 +++++++++++++++++++++++++++++++------------------
 2 files changed, 54 insertions(+), 24 deletions(-)

diff --git a/references/doordash.md b/references/doordash.md
index fd72e78..a925b28 100644
--- a/references/doordash.md
+++ b/references/doordash.md
@@ -1,7 +1,22 @@
-# DoorDash adapter — SCAFFOLD (UNVERIFIED)
+# DoorDash adapter — BLOCKED at bot-wall (first run 2026-08-02)
 
-Status: no live run yet. Every selector below must be verified against the
-real site on first run, then this file promoted to PROVEN with dates.
+Status: first real run attempted 2026-08-02. `doordash.com` (home AND
+`identity.doordash.com/auth`) serves a **Cloudflare Turnstile "Verify you are
+human" interstitial** to the Playwright-launched real Chrome — it never reaches
+the sign-in form (no email field; only "Cloudflare"/"Privacy" links render).
+Direct nav to `/auth` errors ("Client ID cannot be null…") because the OAuth
+params only get injected after passing the wall.
+
+This is the automation-detection signature the `openclaw-real-chrome` skill
+documents. Programmatic Turnstile clicks (iframe locator, coordinate click,
+bounding-box click) were all tried and DID NOT clear it — do not keep hammering.
+**Path forward:** drive DoorDash through `openclaw` (Steve's own real Chrome
+profile, human fingerprint) OR a one-time manual human pass to seed the
+persistent profile, after which the parked session should reconnect over CDP
+like UberEats/Instacart. Both require Steve's go (openclaw needs explicit
+authorization to use his real Chrome).
+
+Selectors below remain UNVERIFIED (never reached the form).
 
 ## Expected auth flow
 
diff --git a/references/instacart.md b/references/instacart.md
index 4903c0d..30d069b 100644
--- a/references/instacart.md
+++ b/references/instacart.md
@@ -1,28 +1,43 @@
-# Instacart adapter — SCAFFOLD (UNVERIFIED)
+# Instacart adapter — PROVEN (2026-08-02)
 
-Status: no live run yet. Every selector below must be verified against the
-real site on first run, then this file promoted to PROVEN with dates.
+Status: verified end-to-end on a live run 2026-08-02 (login → store → address
+book), READ-ONLY (no account writes). Selectors below are confirmed.
 
-## Expected auth flow
+## Auth flow (VERIFIED)
 
-1. `https://www.instacart.com/` → Log in.
-2. Email entry → Instacart favors passwordless email OTP ("Enter the code we
-   sent to …"); password login exists behind "Use password instead" (verify).
-3. Gate types to expect: email OTP (George-readable if it's the user's
-   inbox), occasional SMS OTP.
-4. No card-digit login gate reported (verify).
+1. `https://www.instacart.com/login` → email field `input[type="email"]`
+   (placeholder "Enter your email address"), submit `button:has-text("Continue")`.
+2. Instacart uses passwordless **email OTP**: a 6-digit code, entered in
+   `input[name="code"]` (aria-label "Enter code", maxlength 6). Auto-submits
+   on fill (no explicit Verify click needed). Code arrives from
+   `no-reply@instacart.com`, subject `NNNNNN is your Instacart verification
+   code` — George-readable on the `steve-personal` account, and the code is
+   **in the subject line** (no body parsing needed).
+   - "Request a new code" has a ~10s cooldown.
+3. No SMS gate and NO card-digit gate on this login (unlike UberEats).
+4. Login lands on `https://www.instacart.com/store/?categoryFilter=homeTabForYou`;
+   the current delivery address shows in the top-right header chip.
 
-## After login
+## After login (VERIFIED)
 
-1. Live-order check: Orders page shows active deliveries. Instacart address
-   change on an ACTIVE order is generally NOT self-serve once shopping
-   started — surfaces to care chat (do not attempt without explicit go).
-2. Address book: Account → Addresses → Add new address — autocomplete search;
-   select the exact verbatim match; supports unit + delivery instructions.
-   New orders pick the address at checkout — confirm the default flips to
-   the saved one (verify).
+- Address book: `https://www.instacart.com/store/account/addresses`
+  (direct nav works; also Account → Addresses). Shows every saved address as a
+  row (street / city-state-zip) with a per-row **Edit** link, plus a green
+  **"Add a new address"** button top-right.
+- Live-order check: Orders page shows active deliveries. Address change on an
+  ACTIVE order is generally NOT self-serve once shopping started — surfaces to
+  care chat (do not attempt without explicit go).
+- To SAVE a new address: click "Add a new address" → autocomplete search →
+  select the exact VERBATIM match (per HARD RAIL #1) → supports unit + delivery
+  instructions. New orders pick the address at checkout — confirm the default
+  flips to the saved one.
+- To SURFACE-BEFORE-DELETE: read the full list first (per HARD RAIL #3) and
+  show the user any wrong-looking rows before removing anything.
 
-## Quirks (to confirm on first run)
+## Quirks
 
-- CDP port suggestion: 9225.
-- Instacart sessions are long-lived once the profile persists (verify).
+- CDP port: 9225.
+- Session is long-lived once the persistent profile exists — no bot wall on
+  either the store or login pages (contrast DoorDash, which is Turnstile-walled).
+- The store page renders a huge a11y skip-nav preamble in `innerText`; slice
+  past it when parsing.
← 0814651 5x REPORT: 5 sweeps, 3 defects caught+fixed, final sweep all · back to Delivery Address Fix · (newest)