v2.7.0

New in v2.7.0

The short version: the alarm system used to rely on thresholds fitted in a lab - good numbers, but no promise behind them. v2.7.0 adds an evidence engine with a mathematical false-alarm promise, two new advisory signals, and a hardening merge underneath.

• An alarm with a promise attached. The new e-value tripwire (opt-in) works like a careful gambler's bankroll: if your legitimate users stay under an intensity bound you set, the chance it ever fires falsely is at most the level you picked (say 5%) - guaranteed by construction. In 10,000 simulated legitimate runs it fired 0 times; at the hardest honest boundary, 4.2% against the 5% promise. It caught slicing at a median of 400 records vs 1,225 for the current engine.
• A second shape for quiet-then-loud attacks. The plain bankroll reacts slowly after a long quiet spell, so a Shiryaev-Roberts mode ships alongside: median 14 steps to catch an attack after the quiet period, vs 774 - under its own, different guarantee, stated plainly. A calibration helper measures the bound from your own traffic.
• The honest catch, printed on the box. The promise is exactly as good as your bound: a legitimate workflow running hotter than the bound will eventually trip it - hot-but-honest jobs like bulk importers belong in the declared lanes or need their own bound.
• Hard ceilings, exact in a crowd. Forty workers hammering a declared cap of 600 records overshot to 1,575 on the old check-then-serve path. The new reserve-first path holds exactly 600, zero overshoot - and its holds now expire on a monotonic clock, so a system-clock jump can't stretch or kill them.
• A new signal for feature enumeration (advisory). Input-space coverage watches which features and resources an account touches, not just how much data it takes. In the lab it flags sweep and random-probe enumeration 9 of 9 at the first checkpoint (the current engine: 0 of 9) and a work-splitting herd 72 of 72 members - at a 1.15% legitimate flag rate. It only scores what you declare, and it never blocks anything by itself.
• A new signal for crawler-shaped browsers (advisory). The asset/referrer profile notices browsers that never load images and never carry referrers: 0 false flags in the lab (6,658 legitimate streams, 923 sale-week streams), crawlers flagged 9 of 9 - and shipped deliberately slower-but-surer, needing two bad windows in a row before it flags.
• Verified users stop getting re-challenged. Pass a step-up check once and a new grace window (24 h by default) leaves you alone at ordinary evidence levels. It breaks instantly if evidence jumps to twice the flag line - and it never lifts any budget or ceiling.
• A real bug found and fixed. New heavy-search attack tests caught a bystander being swept into an attack group's flag - worse, the accident shielded one attacker from friction. The grouping rule is fixed: bystander clean, all 16 attackers enrolled.
• Signed-bot verification, re-checked. An independent conformance pack for the RFC 9421 verifier, built from the specification's own example keys: all 12 broken signature variants rejected, false accepts 0.
• Your policy, in the formats agents read. A small generator emits your data-use policy as robots.txt signals, a TDM reservation file and a policy JSON - correct format only, no enforcement claimed.
• All recent hardening, merged in. Every fix shipped in the 2.6.1-2.6.3 patches (idempotency binding, atomic quota enforcement, priced CSV exports, tamper-proof clocks, and more) is part of this line - a pre-release audit caught that the 2.7 development tree had forked before them, and nothing shipped until they were merged back and re-verified.

Suite: 585 tests (583 pass, 0 fail, 2 skipped). Full technical write-up: docs/v2.7.0-deep-dive.md