# Walmart PerimeterX Investigation — v0.0.27 Open Work Item

**Created**: 2026-05-19
**Status**: Open — not scheduled
**Related**: v0.0.25 Phase 5, v0.0.26 Phase 6b, `.dev-squad/serp-detection-audit-FULL.md`

## What We Know

PerimeterX press-hold challenges on Walmart (and similar PerimeterX-protected targets)
remain blocked despite the v0.0.26 Accept-Language frankenlocale fix.

### Signal confirmed absent (fixed in v0.0.26)
- Accept-Language frankenlocale (`en-DE`, `fr-DE`) — now clean at wire level

### Signals still present (not yet fixed)

1. **Mouse trajectory microtimings across full session** — PerimeterX collects mouse
   event timestamps before the challenge appears. The current `behavior.Mouse` Bezier
   implementation may produce trajectories that are statistically distinguishable from
   human. Evidence: v0.0.25 Phase 5 confirmed that the press-hold mechanical action
   itself executes correctly (hold duration, approach angle) but PX still rejects.

2. **Browser engine fingerprint** — PerimeterX's JS probes browser properties that
   vary between Chromium and Firefox in ways that go beyond User-Agent. Specific
   unknowns: Canvas API noise characteristics, WebGL renderer timing, font metric
   rounding, audio fingerprint. These are C++ level in Camoufox vs upstream Firefox.

3. **Session warmup / page engagement signals** — PX challenges typically fire after
   some page load events. The harness navigates directly to the search page without
   simulating a landing page visit, cookie acceptance, or idle time that a real user
   would have. PX may be triggering on "zero engagement before query" pattern.

4. **TLS ClientHello vs User-Agent consistency** — Not specific to PX, but the Phase 6
   HAR diff showed `user-agent: Firefox/135.0` while the Camoufox accept header uses
   Firefox-style format. If PX runs a JA3-to-UA consistency check, any drift would flag.

5. **Navigation header set completeness** — Phase 6b diff shows Camoufox sending
   `sec-fetch-dest`, `sec-fetch-mode`, `sec-fetch-site`, `sec-fetch-user` headers
   on the initial navigation but NOT `sec-ch-ua*` headers (those are Chrome-specific,
   correct for Firefox). PX may expect specific header ordering or presence patterns
   for Firefox-identified requests.

## Recommended Investigation Plan

### Step 1 — Full session HAR capture with warmup
Modify the Phase 6b harness to simulate a realistic session:
1. Navigate to `walmart.com` homepage first (no query)
2. Wait 2-5s (log-normal distributed)
3. Click search bar (Bezier mouse, human-like)
4. Type query with `behavior.Keyboard` timing
5. Submit
6. Compare request count vs current direct-navigate approach

### Step 2 — Canvas/WebGL fingerprint audit
Use `playwright.Page.Evaluate()` to capture the actual canvas 2D fingerprint and
WebGL renderer string Camoufox presents, and compare against what a real Firefox
browser on identical hardware presents. Differences = vectors.

### Step 3 — PX JS probe audit
Capture the PX challenge JS bundle (it's loaded before the challenge renders) and
reverse-engineer what properties it reads. Known PX probes include:
- `navigator.webdriver`
- `window.chrome` (should be undefined in Firefox — verify)
- `document.documentElement.getAttribute('webdriver')`
- Performance timing consistency (requestAnimationFrame timing)
- Mouse event `isTrusted` property

### Step 4 — Session warmup implementation
If Step 1 confirms warmup helps, implement in `behavior/navigation.go`:
`SimulateOrganicLanding(ctx, page, domain)` — randomized idle + scroll before query.

## Files to Modify (When Investigation Proceeds)

- `behavior/navigation.go` — organic landing simulation
- `fetch/camoufox_playwright.go` — pre-challenge warmup hook
- `captcha/detect.go` — PX challenge signal extraction (already has basic PX detection)
- `captcha/` — new `perimeterx_behavioral.go` if behavioral solver is warranted

## Success Criterion

Walmart search page (`/search?q=ipad`) returns real product listings with Camoufox
request count > 50 (consistent with a passing page load, not a challenge redirect).