Spur Monocle anonymized-connection assessment

Tests (browser-zone exit classification — diagnostic, not a harm row). Loads Spur Monocle's browser JS, which produces an encrypted assessment of the connection — whether it looks like a VPN, a proxy, a datacenter egress, or otherwise anonymized. The page relays that encrypted bundle to /monocle/assess, which decrypts it with the operator's Spur secret key and returns the verdict. Run this through an intermediary (residential proxy, datacenter, or an "agent-safe" hosted-browser exit) and compare the verdict to a direct run: if Spur flags the exit as anon / vpn / proxied, the intermediary's exit is not passing as an ordinary residential connection.

The Monocle SDK is served from mcl.betterbrowsing.org (our custom Monocle domain), not Spur's shared js.mcl.io host — some intermediaries host-block the well-known Spur host. A MONOCLE-TIMEOUT with no_bundle means the SDK didn't load or finish within the 60 s budget — that can be a host block or simply an exit too slow to complete. Disambiguate by fetching mcl.betterbrowsing.org/d/mcl.js through the same exit: a 200 means it loaded (so the timeout was latency, not a block); a failure means the host was blocked.

Authenticated: the decrypt/attribution relay (/monocle/assess) is not a free reputation lookup — it only answers requests carrying a valid operator HMAC (the same BBFRONT_KEYS secret as /api/front). The operator's test automation opens this page with a signed token in the URL — /monocle?ts=<unix>&auth=<hmac>&key_id=v1 — and the page forwards it. Without a token the page shows MONOCLE-UNAUTHORIZED and returns no data.

Driven over CDP: a probe navigates here (with the token), waits for document.title to start with MONOCLE-DONE / MONOCLE-TIMEOUT / MONOCLE-UNAUTHORIZED / MONOCLE-UNCONFIGURED, then reads the JSON in #result. The server_observed_ip field is the IP the origin function saw — compare it to assessment.ip (the IP Spur scored) as an exit-coherence check.

initializing…