Repository navigation
[image-generation][release gate] FlatAI public usage permission and capacity #230
Description
Confirmed blocker — 2026-10-10
Draft PR #229 retains the user-approved isolated Playwright architecture, with public enablement default-off.
Evidence
- Three pinned Linux container images built; 9 earlier isolation smoke checks and host-firewall fail-closed lifecycle had passed in WSL.
- A controlled English normal-form generation from the browser container completed normal page load and form interaction but generated no image. First-party POST returned HTTP 403 and JSON
success:false; JSONdatahadmessageandcodefields. Provider-specificcontentBlocked=falseandlimitReached=false; no POST transport failures were observed. A secondary POST returned HTTP 200. Browser UI displayed a generic error. - One independent ordinary Windows Edge probe reached the same form and received two first-party POST 200s but no visible generated image within 100 seconds; background requests reported
ERR_ABORTED. This does not establish success. - Earlier WSL provider attempts timed out/failed. Evidence does not prove whether denial is due to server policy, availability, session, browser environment, or outbound network identity.
Work completed
- Added bounded, first-party HTTP response-status diagnostics
http_403,http_429,http_5xxwithout logging response bodies, prompts, URLs, headers or cookies; preserved specific guard/limit messages over HTTP status where appropriate. - Existing provider circuit breaker, rate limits, no retry after uncertain outcome, browser sandbox and restrictive egress remain intact.
Required resolution and acceptance
- Confirm with FlatAI operator whether automated server-side use of its normal browser UI is permitted, and request the meaning/remediation of their HTTP 403 JSON code. Share sanitized timestamps and correlation identifiers via their supported contact channel.
- Diagnose allowed environmental differences without bypassing CAPTCHA, sign-in, anti-abuse rules, access controls, or rate limits. Do not spoof browser identity, rotate exit IPs, use undocumented endpoint calls or relax network isolation.
- From the intended dedicated Linux host, achieve and document one authorized normal-form generation, validated download bytes and image dimensions, then check a bounded reliability sample. Re-verify sandbox, DNS, direct/private/host/database egress, firewall reload/reboot and backup-retention policy.
- Keep
IMAGE_GENERATION_ENABLEDoff until explicit release approval and independent security review.
If FlatAI does not permit the workflow or cannot resolve its service-side refusal, this backend cannot be treated as production-capable. Preserve the Playwright/isolated worker architecture but use a provider that explicitly authorizes automation.
Activity
alirezasafaeigfx commentedon Oct 10, 2026
2026-10-10 update: A single ordinary Linux browser-form probe yielded first-party HTTP 403 JSON with safe provider error code
signup_required; it did not report a content or usage-limit flag. A new bounded first-party JSON classifier was implemented and its behavior confirmed by invoking the realgenerateWithBrowserinside rebuilt sandboxed Linux Chromium:{code:'signup_required',failureReason:'signup_required',stage:'waiting'}. This is an access requirement; the code now reports and fails closed correctly, but does not create an image or bypass provider restrictions. Provider authorization and successful intended-host generation/download remain open acceptance criteria.alirezasafaei-dev commentedon Oct 11, 2026
Follow-up evidence — 2026-10-11 (no release)
6cc6d913c091b96ae8b42cfb9dabd6bb49b0d0b0. Currentmainis54561b080396754fabb3cd7fe18f1ca07d6bc67f. Public /api/health still reports deployedf58ef7ad7937de8810df5de4dd3a09ffffdec0f4,status=okandready=true; no deployment or feature flag change was made.team@flatai.org(https://flatai.org/about-us/). An inquiry draft requesting explicit authorization, API/partner alternatives, and remediation ofsignup_requiredhas been prepared but not sent. No provider response or permission is claimed.asdev-vpsoffline. Intended dedicated image host sandbox/gateway, firewall reload, reboot, authorized normal-form generation, and validated image bytes remain NOT_RUN.Release decision remains NO-GO: do not merge, deploy or set
IMAGE_GENERATION_ENABLED=true. Next gates are written provider authorization/access resolution, isolated intended-host acceptance (including image decoding/download and network guards), bounded reliability sample, independent review and explicit owner deployment approval. Do not bypass provider safeguards.alirezasafaei-dev commentedon Oct 11, 2026
Owner reprioritization — 2026-10-11
FlatAI is again the primary image-generator research and implementation track. The previous Cloudflare-image experiment PR #239 was closed unmerged after owner explicitly instructed “Cloudflare only for chat.” Existing live chat integration is unaffected. Do not silently substitute a new image provider or reinterpret future test approvals as permanent provider replacement.
Preserve the approved architecture: official site normal-form browser interaction with Playwright and a hardened isolated Linux browser/proxy/worker, as already implemented in draft #229. The Linux
HTTP 403provider codesignup_requiredis currently the hard blocker. Earlier Windows observations did not establish consistent successful output, so do not claim that Windows works definitively or guess whether IP, region, session, registration or service policy caused the denial. Carefully reproduce, compare authorized environments, and report evidence without bypassing signup, CAPTCHA, anti-abuse, network identity, rate limits or exposing undocumented internal endpoints.Owner previously instructed no email to FlatAI. Do not email the provider. Check documented allowed ordinary usage and provider policy independently; if automation is prohibited or signup required, stop and report precise blocker rather than circumvent.
Status: this draft #229 remains OPEN / DRAFT / UNMERGED / UNDEPLOYED, public image generation remains OFF. Before implementation resumed, use issue #230 and current CI/host diagnostics as source-of-truth. Production changes and merge require separate explicit owner approval.
alirezasafaeigfx commentedon Oct 12, 2026
Intended-host technical follow-up on 30dd0ec, 2026-10-12: the owner-confirmed dedicated Linux image host now generated and downloaded real Persian images through the normal Standard form. Final-code direct generation passed in 36s; full encrypted queue/worker/authenticated RPC journeys passed in 78s and 48s. Each decoded JPEG was 832x832; prompt erasure and later physical expiry cleanup passed. No signup/CAPTCHA/quota bypass, identity rotation, cookie export or alternate provider API was used.
A later timeout was caused by the normal Generated Image host im.runware.ai being denied by the narrow proxy. Exact-host allowance, preserving public-only DNS/pinned dialing, corrected that result-loading failure. This is not a finding about the cause of the older WSL HTTP403/signup_required response. Host sandbox/network checks, guard-loss containment, UFW reload, Docker restart and final reboot/key continuity passed; all 17 exact-head CI checks and 49 Linux service tests passed. Details and CI links are in PR229.
The technical "Linux cannot generate" blocker is no longer current for the intended host. Keep this issue open as a public-rollout gate: permitted public multi-user automated use and adequate sustained/free-plan volume remain UNPROVEN. Official free usage is limited; successful small tests are not a high-volume entitlement. Do not contact/email the provider, per the owner's latest instruction. Production integration/release remains separately gated and the public feature remains disabled. No site production deployment occurred.
Sources: https://flatai.org/ai-image-generator-free-no-signup/ ; https://flatai.org/pricing/ ; https://flatai.org/responsible-use/
[-][image-generation][NO-GO] FlatAI rejects isolated Linux browser generation (HTTP 403)[/-][+][image-generation][release gate] FlatAI public usage permission and capacity[/+]