Concept
Agent
Software that sends requests, on its own or for a principal, and may carry a signature claim.
Definition
An agent is any non-human client: a crawler, an AI assistant fetching for a user, a shopping agent, a script. An agent may declare itself (User-Agent, Signature-Agent) and may sign its requests with Web Bot Auth. Silvector reports what it could verify about that claim as one of four verdicts.
Shape
type Verification =
| "verified" // signature valid for a key in the claimed directory
| "verification_failed" // a claim was made and did not hold (forged or spoofed)
| "not_verifiable" // a claim was made but could not be checked now
| "not_identified"; // no claim was madeInvariants
| Invariant | Checked by |
|---|---|
| A spoofed or forged Web Bot Auth claim never fuses to a confident identity. | packages/identity/src/identity-fusion.test.ts: "adversarial: spoofed and forged Web Bot Auth claims never fuse to confident" |
| Fused identity confidence alone never produces a deny. | packages/identity/src/identity-fusion.test.ts: "fused confidence alone never produces a deny in v1" |
| Signature verification follows the published golden cases. | packages/engine/src/engine.test.ts: "web bot auth golden cases" |
Out of scope
- Whether content was written by AI. An agent verdict is about who sent a request, not who wrote a text.
- not_identified is not a finding that the sender is a person, or that it is an agent.