Session modes

A session's mode is visible in every /v1/decide response (session_mode) and reflects which verification phase the session is currently in.

FORGE:BOUND

The default state right after the initial challenge completes: a hardware- bound, cryptographically signed session, not yet through any PULSE ticks.

PULSE:ALIVE / PULSE:SUSPENDED

Once PULSE heartbeats begin, the session moves into one of two states — see PULSE for exactly what drives the transition between them. ALIVE means the most recent tick was clean and the session's deadline keeps extending; SUSPENDED means the most recent tick was robotic, and the deadline is left to expire naturally rather than being force-ended.

GHOST

A fast-path, high-confidence BLOCK state. Two independent triggers reach it:

• The invisible edge layer, early in /v1/decide, for the highest- confidence combination of signals (a known-bad TLS client fingerprint plus a bad-actor registry match) — skipping the rest of scoring entirely.
• A late override, after scoring, when uncanny-valley behavioral timing crosses a high-confidence threshold that only becomes visible once the full signal set is in.

Either path forces BLOCK and routes the session to the shadow queue for review, regardless of what the numeric score would otherwise have been.

MIRROR

A deliberate shadow-routing state for borderline traffic — scores roughly in the 65–80 range. A MIRROR session gets a completely normal response (it is not blocked or challenged based on being in this state); internally, it's also logged to a shadow queue for review. The idea: this band of traffic is genuinely ambiguous, and observing it over time — without acting on the ambiguity — builds better ground truth for future model training than either blocking it (risking false positives on real, borderline-behaving humans) or ignoring it entirely.