Declared cover

A verified agent is one that proved who it is. Only the server can confirm it.

Proof	Checked by
Web Bot Auth (RFC 9421, `tag="web-bot-auth"`)	The API, against `<Signature-Agent>/.well-known/http-message-signatures-directory`
Published agent IP ranges	The API, refreshed daily

agent.verified and da_verified turn true only after check(), getToken() or protect() returns a verified agent.
A declared user agent (ChatGPT-User, Claude-User) names the family but proves nothing.
For access decisions, trust the token, not the browser.

Edge hints

Server-Timing: doubleagent;desc="v=1&wba=1&ua=claude&cfv=1&cfs=12&dc=1"

Hints can only raise suspicion, and their weight is capped. They never produce verified.*.