Signal reference

Findings arrive in signals:

{ "id": "stack.os-contradiction", "tier": "composite", "family": "transport-stack",
  "headline": "…", "detail": "…" }

Use id, tier, and family in code. headline and detail are prose. Read the tier from the finding; a few IDs carry different tiers in different conditions.

Tier	Effect
`absolute`	Conclusive alone. The four refusal IDs below make the verdict `refused`; other absolute findings make it `contradicted`.
`composite`	Makes the verdict `contradicted`.
`conditional`, `weak`	Reported. No effect on the verdict.

Network geometry

ID	Tier	Meaning
`geo.rtt-below-vacuum`	`composite`	The round trip was faster than light could travel from the claimed timezone.
`geo.rtt-below-fibre`	`conditional`	RTT is below the fibre reference. Air or space propagation can be faster; the medium is not measured.
`geo.rtt-far-above-floor`	`weak`	The round trip was much slower than the claimed location would need.
`geo.claims-no-location`	`weak`	The timezone claim gives an offset but no place to compare against.

The comparison uses the nearest possible point in the claimed timezone, so it never assumes an exact location.

Transport stack

ID	Tier	Meaning
`stack.os-contradiction`	`composite`	The observed TCP signature conflicts with the claimed operating system.
`stack.mtu`	`weak`	Estimated maximum packet size for the connection.
`wire.client-malformed-frames`	`weak`	The sensor saw malformed packets from the client address.

Transport reachability

ID	Tier	Meaning
`reach.no-quic-attempt`	`composite`	A browser that supports HTTP/3 was offered it and never tried.
`reach.quic-shape-only`	`weak`	Packets resembling QUIC arrived without a readable handshake.
`reach.quic-same-address-only`	`weak`	QUIC arrived from the same address but could not be tied to the session.
`reach.quic-underpadded-initial`	`composite`	The QUIC handshake packet was smaller than the protocol allows.

TLS construction

ID	Tier	Meaning
`tls.no-grease`	`composite`, `conditional`	The TLS handshake lacks expected GREASE values. Composite for a Chromium claim; conditional when no engine is claimed.
`tls.no-h2-alpn`	`composite`, `conditional`	The TLS handshake does not offer HTTP/2. Composite when a browser engine is claimed.
`tls.pre-1.3`	`composite`, `weak`	The TLS handshake does not offer TLS 1.3. Composite when a browser engine is claimed.
`tls.group-disagreement-across-transports`	`composite`	The TCP and QUIC handshakes from one Chromium session disagree on key-exchange groups.
`tls.group-disagreement-unclassified`	`weak`	The same disagreement, without a Chromium claim.

HTTP construction

ID	Tier	Meaning
`http.h2-stack-contradicts-tls`	`composite`	The TLS handshake matches a browser, while the HTTP/2 preface matches Go `net/http2`.
`http.missing-client-hints`	`composite`	A Chromium user agent arrived without Chromium’s default `Sec-CH-UA` headers.
`http.client-hints-on-non-chromium`	`composite`	A Firefox or Safari user agent arrived with Chromium’s client-hint headers.
`http.h2-fingerprint`	`weak`	HTTP/2 settings and header order, recorded.
`http.headers`	`weak`	Request header names and order, recorded.
`identity.chromium-brand-on-non-chromium`	`composite`	The page reports a `Chromium` brand while the user agent names Firefox or Safari.
`identity.ua-disagreement`	`composite`, `weak`	The request’s user agent and `navigator.userAgent` disagree on engine, OS, or major version. Weak when only the page and collector requests disagree.
`identity.measurement-declined`	`absolute`	The collector request arrived with no measurement and no error. Refusal.
`identity.measurement-withheld`	`absolute`	The browser sent its claims but left out every probe result without reporting a failure. Refusal.
`identity.measurement-unusable`	`conditional`	Every probe reported failure.
`identity.measurement-partial`	`absolute`	A required probe returned neither data nor a failure status. Refusal.
`identity.wasm-unavailable`	`absolute`	The required Wasm measurement was not completed. Refusal.

Compute

ID	Tier	Meaning
`gpu.throughput-software-class`	`conditional`	GPU throughput fell below a CPU-relative reference. This does not establish software rendering.
`gpu.realm-disagreement`	`conditional`	The page and worker reported different GPUs. Adapter switching is not ruled out.
`gpu.gl-caps-contradict-backend`	`composite`	The reported graphics limits do not fit the named graphics backend.
`gpu.gl-limit-contradicts-driver`	`absolute`	An allocation succeeded past a reported limit, or failed at it.
`gpu.renderer-os-contradiction`	`composite`	The GPU driver name belongs to a different operating system than the one claimed.
`gpu.below-claimed-model`	`conditional`	GPU throughput is below the usual range for the claimed GPU. A population comparison, never conclusive.
`compute.clock-below-any-desktop`	`conditional`	CPU loop speed fell below a calibration reference. This is not a measured hardware clock.
`compute.thread-scaling-inversion`	`conditional`	Throughput fell when workers were added. Contention, scheduling and power limits are not ruled out.
`compute.cores-below-claim`	`conditional`	Delivered parallel work fell below the reported processor count. This does not count installed cores.
`compute.cores-exceed-claim`	`conditional`	Measured speedup exceeded the reported processor count. Baseline and scheduling effects are not ruled out.
`compute.cores-above-engine-ceiling`	`composite`	Safari reports more cores than it can.
`compute.deep-memory-latency`	`weak`	Memory access is slower than the reference.
`compute.apple-l1-spill`	`weak`	Cache behaviour does not fit the Apple silicon claim.
`compute.timing-jitter`	`weak`	Repeated CPU timings varied more than an idle machine’s.
`compute.frame-cadence-recorded`	`weak`	Frame timing, recorded.
`identity.canvas-noise-injected`	`weak`	The same canvas scene rendered differently twice.

JavaScript automation and integrity

Collector 0.2.5 runs the basic automation, navigator getter and plugin checks even with surface: false. Realm, engine and detailed WebGL checks require their corresponding measurements. Missing evidence never establishes that a browser is unmodified. Fingerprinting coverage explains these limits.

ID	Tier	Meaning
`identity.webdriver-declared`	`composite`	A root, surface or observed realm reports `navigator.webdriver: true`.
`identity.automation-globals`	`composite`	Recognized driver globals are present, including ChromeDriver and Playwright markers. Fixed global names require an exact match.
`identity.headless-user-agent`	`absolute`	A user agent explicitly names a headless build.
`integrity.browser-reflection-rewritten`	`composite`	Reflection functions used by the passive checks have been replaced. Dependent checks abstain.
`integrity.screen-property-rewritten`	`composite`	A Screen getter was replaced with an own property, data property or JavaScript getter.
`integrity.screen-receiver-bypass`	`composite`	A Screen getter accepted a non-Screen receiver.
`integrity.rendering-api-rewritten`	`composite`	A Canvas or audio method was replaced. Page instrumentation can cause this too.
`integrity.rendering-receiver-bypass`	`composite`	A Canvas or audio method accepted an invalid receiver.
`integrity.navigator-property-rewritten`	`composite`	A navigator getter has been shadowed, replaced with data, or replaced with JavaScript.
`integrity.navigator-receiver-bypass`	`composite`	A navigator getter accepts a plain object where an engine getter requires a Navigator receiver.
`integrity.plugin-mime-inconsistent`	`composite`	Plugin or MIME collections are arrays, contradict their lookup methods, or advertise inconsistent plugin references. Empty collections are allowed.
`integrity.reflection-patched`	`composite`	Reflection used to inspect WebGL methods has been replaced.
`integrity.webgl-method-not-native`	`composite`	A WebGL prototype method is no longer a native method.
`integrity.webgl-method-descriptor-altered`	`composite`	A WebGL method has a changed property descriptor.
`integrity.webgl-method-rebound`	`composite`	A WebGL method has a changed name or argument count.
`integrity.webgl2-core-missing`	`composite`	A context identifies as WebGL 2 but lacks required methods.
`integrity.webgl-extension-list-contradicts-itself`	`composite`	Supported-extension enumeration disagrees with extension lookup.
`integrity.realm-navigator-desync`	`composite`	Observed realms disagree on a stable navigator value. Core availability and WebKit desktop-mode platform differences are excluded.
`integrity.realm-eval-length-desync`	`composite`	Realms print the same engine builtin at different lengths.
`integrity.realm-global-scope-wrong`	`composite`	A window or worker reports the wrong global-object type.
`integrity.realm-timezone-desync`	`composite`	An observed realm resolves a different timezone.
`identity.driver-binding-installed`	`composite`	The probe-page script observed a driver binding wrapper or controller.
`identity.service-worker-registration-stubbed`	`composite`	The probe demo observed a replaced service-worker registration method.
`identity.main-world-context-lookup`	`composite`	The probe-page trap observed direct main-world evaluation. DevTools can produce it too.
`identity.closed-shadow-interaction`	`composite`	An unrendered control inside a closed shadow root was activated. The current demo control is not actionable by normal driver clicks.

The four probe-demo traps above run only on the demo page. Customer pages use passive driver-global checks.

Canvas, permission and media checks

These checks run on customer pages even with surface: false and render: false. All four IDs belong to http-construction and are composite findings.

ID	Tier	Meaning
`integrity.canvas-pixel-altered`	`composite`	An opaque Canvas2D byte read returned different pixels from those written for this session. Built-in fingerprint protection or an extension can cause this.
`integrity.permission-result-fabricated`	`composite`	A successful permission query returned an object rejected by the checked native PermissionStatus getter.
`integrity.permission-state-invalid`	`composite`	A successful permission query returned a state other than `granted`, `denied`, or `prompt`.
`integrity.media-query-disagreement`	`composite`	CSS and JavaScript returned different answers to the same media query while the environment and controls stayed stable.

A canvas finding reports altered pixels; it does not identify a GPU or the software that changed them. Permission checks inspect one returned object and never request permission. A denied permission is valid. The media check requires two stable samples and successful stylesheet controls. A blocked stylesheet, unavailable API, changed preference, or failed control leaves that check unavailable. It cannot establish a disagreement. The canvas check similarly requires an unchanged input buffer and a supported, intact drawing context. Each check must report a result or an explicit unavailable/error status. Omitting or corrupting a required section causes identity.measurement-partial and a refused verdict. This completeness requirement also applies when optional collection is disabled.

Rectangle, empty-text font and PNG checks

Collector 0.2.5 adds three checks to activeIntegrity version 2. They run even when optional rendering and surface collection are disabled.

ID	Tier	Meaning
`integrity.rectangle-api-disagreement`	`composite`	The rectangle APIs returned different origin coordinates for one stable layout box in an isolated frame.
`integrity.font-empty-text-rejected`	`composite`	A font check rejected an empty string in an active document. No characters require a font, including when a matching web font is unloaded.
`integrity.canvas-png-altered`	`composite`	Direct canvas readback matched the written bytes, but decoding its PNG returned different pixels.

Rectangle dimensions can undergo different native rounding and do not trigger this check. PNG compression and encoded length can vary; the PNG check compares decoded opaque sRGB pixels. Unsupported APIs, failed controls and changing layout are reported explicitly. None of these findings identifies a browser vendor or establishes automation by itself.

Engine and device consistency

ID	Tier	Meaning
`engine.navigator-constant-wrong`	`composite`	A frozen navigator constant has a different value.
`engine.product-sub-contradicts-engine`	`composite`	`productSub` disagrees with the declared engine.
`engine.vendor-contradicts-engine`	`composite`	Navigator vendor disagrees with the declared engine.
`engine.app-version-contradicts-user-agent`	`composite`	The app-version string disagrees with the user agent it derives from.
`engine.gecko-only-field-on-non-gecko`	`composite`	Gecko-only navigator fields appear under another engine’s declaration.
`engine.chromium-api-on-non-chromium`	`composite`	A checked Chromium-only interface appears under another engine’s declaration.
`engine.stack-frame-style-contradicts-engine`	`composite`	Error stack format disagrees with the declared engine.
`engine.claim-differs-between-reads`	`composite`	Repeated stable navigator or client-hint reads disagree, including root versus main-realm snapshots and architecture/bitness. Scheduling-dependent core counts are excluded.
`engine.codec-support-contradicts-engine`	`composite`	A checked codec answer contradicts the engine’s behavior.
`engine.language-contradicts-languages`	`composite`	The primary language disagrees with the language list on a checked engine.
`engine.device-memory-not-a-power-of-two`	`composite`	The reported memory value does not follow the browser engine’s rounding rules.
`identity.platform-contradicts-ua`	`composite`	An iPhone user agent reports a desktop Mac platform.
`identity.ua-version-contradicts-client-hints`	`composite`	The user agent and real brands in client hints disagree on major version. GREASE brands are ignored.
`compute.mac-silicon-on-handset`	`composite`	A handset claim names Mac-only silicon.
`compute.handset-core-ceiling`	`composite`	An iPhone claim exceeds the checked handset core ceiling.
`compute.device-memory-on-non-chromium`	`composite`	Device memory is reported by an engine that does not implement it.
`net.datacenter-egress`	`composite`	The observed address belongs to a classified hosting network. Customer policy decides whether to allow it.
`net.handset-from-datacenter`	`composite`	A handset claim arrived through a classified hosting network.
`geo.timezone-country-differs-from-address`	`conditional`	Declared timezone countries differ from the address’s country. Travel and timezone settings are not ruled out.

Display and locale

ID	Tier	Meaning
`display.avail-exceeds-screen`	`absolute`	Reported available screen dimensions exceed full screen dimensions.
`display.inner-exceeds-outer`	`absolute`	Reported viewport dimensions exceed window dimensions under the rule’s guards.
`display.colour-depth-inconsistent`	`absolute`	Color and pixel depth contradict each other.
`display.window-has-no-chrome`	`conditional`	The window reports no browser chrome. Standalone apps can do this.
`display.mobile-claim-without-touch`	`conditional`	A handset claim reports no touch points.
`display.pointer-contradicts-touch`	`conditional`	A handset reports a coarse pointer with hover.
`display.scripting-disabled-while-scripting`	`conditional`	A script reports that scripting is disabled.
`display.timezone-offset-contradicts-zone`	`composite`	The reported UTC offset is outside the rule’s valid offset constraints.
`display.locale-services-disagree`	`composite`	ICU services resolve different default languages.
`display.intl-timezone-disagrees-across-reads`	`composite`	Repeated default-timezone reads disagree.

Measurement arithmetic and protocol consistency

ID	Tier	Meaning
`attest.wasm-artifact-rejected`	`composite`	The Wasm artifact or measurement failed its required integrity check.
`attest.wasm-contract-mismatch`	`absolute`	Successful-result versions or iteration count disagree with the pinned contract.
`attest.wasm-checksum-mismatch`	`absolute`	The returned integer-kernel checksum is wrong for the session nonce.
`attest.wasm-artifact-substituted`	`absolute`	The reported Wasm artifact is not the sensor’s artifact.
`attest.wasm-nonce-commitment-wrong`	`absolute`	The Wasm commitment belongs to a different session nonce.
`attest.parallel-identity-violated`	`composite`	Parallel summary fields disagree with their own inputs.
`attest.parallel-superlinear`	`composite`	A result marked reliable violates the collector’s own efficiency condition.
`attest.compute-min-above-median`	`absolute`	A reported minimum exceeds its own median.
`attest.compute-zero-spread`	`composite`	Every compute lane has exactly zero spread under the rule’s timer and sample guards.
`attest.gpu-identity-violated`	`composite`	GPU throughput disagrees with the work and duration reported by the same probe.
`reach.client-claims-h3-without-quic`	`composite`, `conditional`	A reported HTTP/3 exchange lacks matching captured QUIC evidence. Sensor impairment changes the tier.
`tls.key-share-not-subset-of-groups`	`absolute`	A key share uses a group missing from supported groups.
`tls.psk-not-last-extension`	`absolute`	The pre-shared-key extension is not last.
`tls.duplicate-extension`	`absolute`	A TLS extension type occurs twice.
`tls.compression-methods-non-null`	`absolute`	TLS 1.3 offers non-null compression.
`reach.quic-initial-dcid-below-minimum`	`absolute`	A QUIC Initial destination connection ID is below the protocol minimum.
`stack.syn-protocol-violation`	`composite`	SYN options violate the checked TCP constraints.
`stack.syn-stray-ack`	`conditional`	A SYN has an acknowledgement number without the ACK flag.
`http.h2-settings-not-ascending`	`conditional`	A Chromium declaration sends non-ascending HTTP/2 setting IDs.
`http.h2-connection-specific-header`	`conditional`	A connection-specific header was observed on HTTP/2 or HTTP/3.
`http.accept-language-contradicts-navigator-languages`	`conditional`	The request’s language preference differs from the script declaration.
`tls.alpn-negotiated-protocol-mismatch`	`conditional`	Captured ALPN and request protocol disagree.
`stack.ts-clock-rate-implausible`	`conditional`	Observed TCP timestamp rate differs from nominal clock rates.

Store provenance.assessment_schema and provenance.ruleset_revision with results you need to compare across releases. Use the tier returned in each result.

Get started

Application integration

Collector

Challenge widget

Clearance

Frameworks and server clients

Understand Heretic

Reference

Manage and troubleshoot

Signal reference

Network geometry

Transport stack

Transport reachability

TLS construction

HTTP construction

Compute

JavaScript automation and integrity

Canvas, permission and media checks

Rectangle, empty-text font and PNG checks

Engine and device consistency

Display and locale

Measurement arithmetic and protocol consistency

​Network geometry

​Transport stack

​Transport reachability

​TLS construction

​HTTP construction

​Compute

​JavaScript automation and integrity

​Canvas, permission and media checks

​Rectangle, empty-text font and PNG checks

​Engine and device consistency

​Display and locale

​Measurement arithmetic and protocol consistency

Network geometry

Transport stack

Transport reachability

TLS construction

HTTP construction

Compute

JavaScript automation and integrity

Canvas, permission and media checks

Rectangle, empty-text font and PNG checks

Engine and device consistency

Display and locale

Measurement arithmetic and protocol consistency