v1.27.0

A browser detectable only by how it moves can now be blocked.

Fixed

A source-patched browser scrubs every JS-observable automation flag at the binary level, so it trips no headless, CDP, fingerprint, datacenter or bot category. Because the final score is a weighted sum, that unused budget was silently kept — leaving such a browser a ceiling of 0.41 against a 0.5 threshold. It could not be blocked however obviously robotic its movement was.

The corpus sample of that adversary tripped seven correct behavioural detections — absent micro-tremor, unnaturally direct path, unnatural click precision, consistent event timing, consistent velocity, no overshoot corrections, movements too straight — and scored 0.234. Allowed, token issued. Every detector fired; the aggregation discarded the verdict.

The score is now floored at 0.6 when two or more behavioural categories independently reach 0.5. Corroboration across independent views is itself evidence, distinct from any one of them being strong — the same shape as the existing dispositive floor, earned by agreement rather than self-declaration.

That sample now scores 0.600, recommendation block, no token, on all three servers.

The constants were swept, not chosen

Measured against the labelled corpus over a 40-point grid (bench/tools/sweep-corroboration.js, included):

threshold   humans reaching 2+     agents reaching 2+
0.30         0 of 126               75 of 75
0.50         0 of 126               66 of 75
0.70         0 of 126               47 of 75

No human in the 126-sample panel reaches two agreeing behavioural categories at any threshold tested. Requiring three categories fails outright — all sixteen such combinations leave the adversary allowed.

No effect on legitimate traffic: human panel median 0.088 and maximum 0.130, unchanged. Benchmark false-positive rate 0.00%. Gate passes.

Also fixes the benchmark harness timing its challenge wait from before the request rather than from the response, which let network latency eat the margin and failed the gate intermittently.

Added

COMPLIANCE.md — what is collected, what is retained and for how long, verified against the source. Written for a DPO or a procurement questionnaire: enumerated retention windows, no disk persistence, and the automated-decision-making and accessibility positions.

Note

The adversary above is one synthetic, hand-authored corpus sample. This shows the arithmetic works on the shape the corpus describes, not that it works against a real source-patched browser. Captured traces from real browsers remain the highest-value contribution to this project.