Stage 5b blocker: OpenRouter signup moved to Clerk; Stage 5a scraper selectors invalidated

[hanwencheng]

Summary

The Stage 5a deterministic scraper for OpenRouter (provisioner-scripts/src/scrapers/openrouter.ts) cannot complete agentkeys provision openrouter against the current live site. The Stage 5a infrastructure (entry-point guard, orchestrator log-file on no-terminal-event, catch-all error reporting in main()) all work correctly — but OpenRouter has migrated its sign-up flow to Clerk-hosted pages with a Radix UI component tree, so the hardcoded selectors no longer match.

This is the exact DOM-drift scenario Stage 5b's agentic fallback is designed to solve.

Evidence (captured 2026-04-20)

Standalone probe via provisioner-scripts/diag-openrouter.mjs (artifacts under /tmp/or-diag/ after running):

What the scraper expects	What OpenRouter actually serves
GET https://openrouter.ai/auth	301 → https://openrouter.ai/sign-up?redirect_url=... (Clerk-hosted flow)
input[name="email"]	input#emailAddress-field (name=emailAddress, placeholder="Enter your email address")
button[type="submit"]	button with text "Sign Up" (no type attribute); multiple "Sign Up" buttons on the page
/keys dashboard after OTP	Unknown — never reached

Component IDs have the Radix UI radix-_R_* signature, confirming the frontend stack changed.

Submitting the email field + clicking the first "Sign Up" button does not change the URL. Clerk likely requires additional fields (password?) or triggered bot detection against headless Chromium.

Repro

cd provisioner-scripts
export AGENTKEYS_SIGNUP_EMAIL="you+or-$(date +%s)@gmail.com"
node diag-openrouter.mjs
ls /tmp/or-diag/   # screenshots + HTML snapshots + candidates.json

What's still working

• openrouter.ts entry-point guard (silent exit-0 bug fixed in PR docs(stage5): concrete 'Run it' runbook for the live OpenRouter demo #49)
• Orchestrator log-file on no-terminal-event path
• Loud error surface with full stack trace from catch-all in main()
• Gmail IMAP login with plus-alias user (verified via diag-imap.mjs)
• Mock-backend credential storage, init/read, broader test suite (15/15 TS + 15/15 Rust)

What Stage 5b needs to deliver

1. Agentic fallback when a Tier 2 scraper tripwires — drive OpenRouter signup through Clerk's UI via MCP browser primitives
2. /agentkeys-record-scraper skill that records a new Tier 2 scraper variant from a human-guided walkthrough (would produce an openrouter-clerk.ts scraper alongside the legacy one)
3. Fallback → PR loop that auto-submits the recorded scraper as a PR when running non-TTY

Short-term workaround

Manually update openrouter.ts to target Clerk's DOM (input#emailAddress-field, click "Sign Up" by text, handle whatever post-submit fields Clerk adds) — but this is fragile; Clerk frequently updates its hosted signup UI.

Related

• PR docs(stage5): concrete 'Run it' runbook for the live OpenRouter demo #49 (docs/stage5-demo-runbook-fix) — ralph-session evidence + diag tooling
• docs/manual-test-stage5.md §Failure modes — anticipated this class of failure
• docs/spec/plans/development-stages.md — Stage 5b scope

[hanwencheng]

closed by #52