v1.9.0

1.9.0 (2026-06-27)

Features

• arena: add Quick, Draw! doodle image-select (CC BY 4.0) — the second image source (204135e)
• arena: emoji image-select gate (Noto Emoji, OFL) — real CV, not shapes (ca17fa4)
• arena: harden text-captcha noise + add the verify-you-are-human checkbox (823f658)
• arena: image-select + rotate captcha gates (the interactive visual families) (eec1ba8)
• arena: pact / private-access-token gate — skip the challenge on a personhood token (2f9f1c9)
• arena: per-gate difficulty levels (easy/medium/hard) as a cost dial (1bbd748)
• arena: public challenge-gate service + detector relay (arena MVP backend) (0b28193)
• arena: self-hosted CAPTCHA gates (text image · math · honeypot) (2c28549)
• arena: slider captcha — drag-to-fit + behavioural trajectory check (GeeTest-style) (dbe4579)
• contracts: arena scope-as-code — challenge + finding contracts, owned-only allow-list (2cefd46)
• detector: arena gates auto-serve on load as bypass-testing pages (5b517a7)
• detector: managed-challenge ladder gate (Turnstile-style) on the arena (2821040)
• detector: pull geo data keylessly at deploy so the wire panel resolves it (db178ad)
• detector: rebuild the arena as per-challenge pages on the shared site shell (8dbe333)
• detector: the public /arena page — in-browser solver + dual verdict (3cebc5a)
• edge: capture reused TLS-resumption ticket; add the ticket-reuse coordination binding (c286721)
• edge: detect HTTP/2 MadeYouReset stream-reset coercion (CVE-2025-8671) (748bca6)
• edge: detect Web Bot Auth in-window nonce replay (RFC 9421 / G32) (dbcce67)
• evaders: browserless arena-solver that beats every arena gate (owned gates only) (d5710af)
• evaders: computer-vision classifier beats the hardened image-select gate (7eeeeae)
• evaders: solve the arena distorted-text gate with a HuggingFace OCR model (77a1045)
• fleet: add fuzzy-rotate fleet + measure the cross-JA4 similarity FP boundary (83402e5)
• fleet: add Skulk, a fleet adversary-emulation kit for coordination-defense testing (22b4621)
• harness: add template-similarity coordination rung (closes the fuzzy-trace gap) (506a837)
• harness: live-ground the fleet-coordination axis end-to-end (1210d7b)

Bug Fixes

• arena: make rotate behavioural — score the drag trajectory, not a submitted angle (20fd62e)
• arena: rasterize the text + image-select gates so they need OCR/CV, not markup (6713eac)
• detector: open the network/wire panel by default too (b6db2ab)
• detector: stack the detections table into cards on mobile (3b509c6)
• repo: run the arena in the pull-based production deploy (454367a)