# 0A. UBMA Combo · Ultimate Browser Media Automation

> **TASK:** Single mental model — Full-Merged laws + Ultimate engine.
> **WHEN:** Before any Path A/B/C work; every agent session.
> **WHY:** Prevents engine-only ban loops and law-only unfinished wiring.
> **SKILL:** COMBO §1±§11 → START-HERE #0.
>
> **RULES:** Laws decide if/when; engine decides how browser moves. Never reverse. 1 account ↔ 1 VPS IP. Three-state only.
> **TIPS:** Open this file then START-HERE. HAR: determinist first, agent rescue once.

---

## 1) PROMPT / METHOD (AI agent)

You operate **Ultimate-Browser-Media-Automation (UBMA)**.

```
CONSTITUTION = FULL-MERGED-MANAGER-HYBRID-UNIFIED.md   (Hybrid 4.7 laws)
ENGINE       = Ultimate hybrid stack-media automation.md (Path B: browser-use + Patchright/Cloak + residential)
COMBO        = this file
RUNTIME      = /var/www/media.addict.best/docs/ULTIMATE-BROWSER-MEDIA-AUTOMATION-COMBO.md
```

### Hard rules (non-negotiable)

1. Never violate Mode C, encrypted cookies, Bezier `smart_click`, three-state QA.
2. Prefer deterministic Patchright steps; `browser-use` only when DOM unknown/broken.
3. Same browser session for script + agent. Save `.enc`/`storage_state` after success.
4. Proxy geo = timezone = locale. No datacenter IPs for social.
5. Shadowban canary empty ⤬ L3 48 h. Max one adaptive rescue, then stop.
6. No platform APIs; no captcha bypass; `passive_only: true`.
7. INCONCLUSIVE blocks done. Evidence required for PASS.
8. Strip GPT-isms (delve, tapestry, unlock, landscape, elevate, moreover, testament).

### Pipeline

```
boot → gates → session → deterministic (agent rescue) → verify → save → three-state report
```

### Incident map

| Code | Severity | Action |
|------|----------|--------|
| 301 | L1 | Reduce rate 50%, re-try |
| 308 | L2 | Re-export cookies, swap session |
| 310 | L3 | HALT 48 h, quarantine account |

---

## 2) FREE TOOLS (Mac + Linux VPS, no API required for core path)

- **macOS / Linux:** Python 3.10+, `patchright`, `browser-use` (Path B), `cryptography`, `pyyaml`
- **Free / local:** Patchright Chromium, Playwright (deterministic), Omni Python scripts under media omni agents
- **Runtime CLI (no API key for gates/scripts):** omni-hybrid-merged/omni_cli.py
- **Optional LLM** only for Path B adaptive slices (local Ollama if configured; else human/script path)
- **Docs to load:** this file, START-HERE-MERGED.md, FULL-MERGED-MANAGER-HYBRID-UNIFIED.md, Ultimate hybrid stack-media automation.md

### Linux VPS deploy (Hetzner / Contabo / Hostinger)

```bash
# ponytail: same Python stack on Mac and Linux; only proxy source differs
ssh -i ~/.ssh/contabo2_new1 root@149.102.150.185     # or hetzner / hostinger / ai-developer
python3 -m venv ~/.venv-ubma && source ~/.venv-ubma/bin/activate
pip install --upgrade pip
pip install patchright browser-use cryptography pyyaml
patchright install chromium
```

### Mode C (live multi-account) — one account ↔ one VPS IP forever

| Alias | SSH |
|-------|-----|
| hostinger | `ssh hostinger` |
| contabo2 | `ssh -i ~/.ssh/contabo2_new1 root@149.102.150.185` |
| hetzner | `ssh -i ~/.ssh/hetzner_dokploy root@46.62.228.173` |
| ai-developer | `ssh -i ~/.ssh/ai_developer_key root@213.199.36.17` |

---

## 3) CODE / COMMANDS

```bash
# Paths
COMBO="/var/www/media.addict.best/docs/ULTIMATE-BROWSER-MEDIA-AUTOMATION-COMBO.md"
FULL="/var/www/media.addict.best/docs/FULL-MERGED-MANAGER-HYBRID-UNIFIED.md"
ULT="/var/www/media.addict.best/docs/Ultimate hybrid stack-media automation.md"
OMNI_MERGED="/var/www/media.addict.best/docs"   # all five files live here

# Read combo + boot runtime
sed -n '1,80p' "$COMBO"
cd "$OMNI_MERGED" && python3 check_merge.py && python3 omni_cli.py boot
python3 omni_cli.py status
python3 omni_cli.py prompt   # paste into agent session
```

### Encrypted cookie contract

```python
# ponytail: cookies encrypted at rest; plaintext deleted after .enc write; chmod 600
from cryptography.fernet import Fernet
import json, os, stat

key = open(os.path.expanduser("~/.config/ubma/key")).read().strip()  # Fernet.generate_key() once
f   = Fernet(key)

def save_cookies(account: str, cookies: list, storage_state: dict):
    blob = json.dumps({"cookies": cookies, "storage_state": storage_state}).encode()
    path = f"sessions/{account}.enc"
    open(path, "wb").write(f.encrypt(blob))
    os.chmod(path, stat.S_IRUSR | stat.S_IWUSR)

def load_cookies(account: str):
    blob = f.decrypt(open(f"sessions/{account}.enc", "rb").read())
    return json.loads(blob)
```

### Deterministic Patchright (Path B primary)

```python
# ponytail: same session contract as omni doc; never vanilla Playwright for live social
from patchright.sync_api import sync_playwright

with sync_playwright() as p:
    browser = p.chromium.launch_persistent_context(
        user_data_dir="~/.config/patchright/profiles/acct1",
        headless=False,
        # ponytail: residential proxy only; never datacenter for IG/TT/FB
        proxy={"server": "http://residential-eb:3000"},
    )
    page = browser.new_page()
    # inject cookies BEFORE navigate; never after
    page.context.add_cookies(cookies)
    page.goto("https://www.instagram.com/")
    # save storage_state AFTER success only
    page.context.storage_state(path="storage_state.json")
```

### Adaptive rescue (browser-use, only when Patchright breaks)

```python
# ponytail: agent.run() only on fractures; max 1 rescue per task; warm-up 3–7 days on new accounts
from browser_use import Agent, Browser, BrowserSession
from browser_use.sync_api import BrowserSession

session = BrowserSession(
    executable_path="<patchright chromium>",
    user_data_dir="~/.config/browseruse/profiles/acct1",
    headless=False,
)
agent = Agent(task="publish the prepared reel to IG", llm=<llm>, browser_session=session)
import asyncio; asyncio.run(agent.run())
```

### Three-state QA gate

```bash
# ponytail: three-state gate; INCONCLUSIVE is NOT a pass
final_gate() {
  local qa_json="$1"
  local verdict
  verdict=$(jq -r '.verdict' "$qa_json" 2>/dev/null)
  case "$verdict" in
    PASS)         echo "✅ ship — $(jq -r '.reason // "all checks passed"' "$qa_json")"; return 0 ;;
    FAIL)         echo "❌ fix: $(jq -r '.reason // "unspecified failure"' "$qa_json")"; return 1 ;;
    INCONCLUSIVE) echo "⚠️  re-run: $(jq -r '.reason // "could not measure"' "$qa_json")"; return 2 ;;
    *)            echo "⚠️  unknown verdict '$verdict' — treat as INCONCLUSIVE"; return 2 ;;
  esac
}
```

---

## 4) SHADOWBAN CANARY (real, on tag chrono tab)

```bash
# ponytail: empty result ⤬ L3 48 h pause; max one adaptive rescue, then stop
python3 omni_cli.py shadowban --account "$ACCT" --canary-tag "$TAG"
```

If output is empty / INCONCLUSIVE → quarantine account 48 h, do not retry in tight loop.

---

## 5) SELF-CHECK (run after every render / publish)

```
[ ] Cookies loaded before navigate
[ ] smart_click (Bezier) used, no raw page.click
[ ] Same session for script + agent
[ ] storage_state saved after success
[ ] Proxy geo = tz = locale (no datacenter IP for IG/TT/FB)
[ ] Three-state verdict reached (PASS/FAIL/INCONCLUSIVE)
[ ] INCONCLUSIVE never promoted to PASS
[ ] No platform API used
[ ] No captcha bypass attempted
[ ] GPT-isms stripped from output
```

---

## 6) ANTI-PATTERNS (do not do)

- ❌ Vanilla Playwright on live social (CDP fingerprints leak)
- ❌ Datacenter IP for IG/TT/FB
- ❌ Cookies injected after navigate
- ❌ `expires=-1` session cookies discarded
- ❌ Raw `page.click()` (use Bezier `smart_click`)
- ❌ Promoting INCONCLUSIVE to PASS
- ❌ Multi-account on one VPS IP (breaks Mode C)
- ❌ Same proxy for accounts on different platforms (cross-leak)

---

## 7) RELATED FILES (load together)

| File | Role |
|------|------|
| `FULL-MERGED-MANAGER-HYBRID-UNIFIED.md` | Constitution / Hybrid 4.7 laws |
| `Ultimate hybrid stack-media automation.md` | Engine / Path B browser-use stack |
| `Lead generation and media automation.md` | 11 free lead-gen methods (ethical) |
| `social media overgrowth.md` | Hub-spoke + retention OS |
| **`ULTIMATE-BROWSER-MEDIA-AUTOMATION-COMBO.md`** (this file) | Combo: laws + engine in one mental model |

---

*Authored 2026-08-09 for media.addict.best · Sourced from in-app UBMA box + Hybrid 4.7 laws + browser-use stack. No paid dependencies. Passive-only ethics.*