{ "v": 1, "observers": [ { "observer_id": "crawlcheck-worker", "class": "primary", "status": "active", "operator": "CrawlCheck (VSNARY)", "software": "crawlcheck Worker", "network": "CrawlCheck primary network", "signing": { "kind": "web_bot_auth_ed25519", "directory": "https://crawlcheck.io/.well-known/http-message-signatures-directory", "signs": "the sealed manifest of each scan" } }, { "observer_id": "gha-azure-1", "class": "secondary_cloud", "status": "active", "enrolled_at": "2026-09-30", "operator": "CrawlCheck (VSNARY)", "software": "crawlcheck-observer (.github/scripts/observer.mjs)", "network": "GitHub-hosted runners on Microsoft Azure; not any crawler operator's network, so it corroborates a vantage question, never an operator's own crawl", "signing": { "kind": "ephemeral_ed25519_bound_by_github_oidc", "issuer": "https://token.actions.githubusercontent.com", "repository": "emmanuelorta/crawlcheck", "workflow_ref_prefix": "emmanuelorta/crawlcheck/.github/workflows/observer.yml@refs/heads/", "runner_environment": "github-hosted", "audience": "crawlcheck-observer:", "rotation": "a new key every run; the enrolled identity is the workflow, checked against GitHub's published keys" }, "scope": { "urls": "the scanned homepage URL of a queued or requested domain", "method": "GET", "request_profiles": "the primary scan's identity profiles, served by /api/observe/tasks and hashed (profile_sha256)" }, "data_minimization": "no cookies sent or kept; fixed request headers; response bodies stored by content hash exactly like primary fetches; the runner's public address and network name are recorded as vantage metadata", "clock": "observed_at must be within 30 minutes of receipt; skew against the Worker's Date header is recorded" }, { "observer_id": "ext:*", "class": "customer_browser_extension", "status": "active", "enrolled_at": "2026-09-30", "operator": "people running the CrawlCheck extension (version 1.0.4 and later) with sharing switched on", "software": "CrawlCheck browser extension", "network": "the visitor's own connection (home, office or mobile), recorded as country and network name only; the address is never stored", "signing": { "kind": "per_install_ecdsa_p256", "enrollment": "trust on first use: each install makes its own key on first share; its RFC 7638 thumbprint is the observer id (ext:)", "message": "crawlcheck-extension-observation-v1\n + canonical JSON of the reading without sig", "revocation": "per key (STATS obsrevoke:ext:)" }, "scope": { "urls": "the page the person pressed Two vantages on", "data": "per identity: HTTP status, bytes, visible word count, body hash, verdict class; never page content, cookies or input" }, "caveat": "an install key shows a reading came unaltered from one install; it does not identify a person and is not an operator's crawler" }, { "observer_id": "ind:cli-2ns-x7r1zy", "class": "independent", "status": "active", "vetted": false, "enrolled_at": "2026-10-07T14:31:08.168Z", "operator": "CrawlCheck (VSNARY), PHP client test from a Google Cloud container", "software": { "name": "crawlcheck-observer-wordpress", "version": "1.0.0" }, "network": { "declared": "this machine's network", "measured_at_enrolment": { "asn": 396982, "as_org": "Anthropic, PBC", "country": "US", "region": "Ohio", "city": "Columbus", "network_class": "independent" }, "network_class": "independent" }, "signing": { "kind": "enrolled_ed25519", "key": { "kty": "OKP", "crv": "Ed25519", "x": "x1z-42L-Q_nFF8i1F63kBP38kbqDv66q8RcxA2mKTz8" }, "kid": "2nS-X7r1ZyknyV7mJYs7qigrcDv2vsDFwF3S7Xtqnd8", "binding": "trust on first use: the id is bound to this key; observations must carry exactly this key and verify under it", "message": "crawlcheck-observation-v1\n + canonical JSON of the envelope" }, "enrolment": { "request": { "key": { "crv": "Ed25519", "kty": "OKP", "x": "x1z-42L-Q_nFF8i1F63kBP38kbqDv66q8RcxA2mKTz8" }, "kind": "crawlcheck-observer-enrolment", "network": "this machine's network", "observer_id": "ind:cli-2ns-x7r1zy", "operator": "CrawlCheck (VSNARY), PHP client test from a Google Cloud container", "requested_at": "2026-10-07T14:31:06.000Z", "software": { "name": "crawlcheck-observer-wordpress", "version": "1.0.0" }, "v": 1 }, "sig": "LLKUK9raVJefVzyTXihYW0A2-O9NGRT6c2VlAFlopHCuO3te5E5HTl4WkBl3Qtnrv3UgIsghK5NyqD7yZxyIDA", "message": "crawlcheck-observer-enrol-v1\n + canonical JSON of request" } }, { "observer_id": "ind:gcp-session-1", "class": "independent", "status": "active", "vetted": false, "enrolled_at": "2026-10-02T04:59:37.550Z", "operator": "CrawlCheck (VSNARY), run from a Claude cloud session", "software": { "name": "crawlcheck-open-observer", "version": "1.0.0" }, "network": { "declared": "Google Cloud egress (AS396982), not Cloudflare, not Azure", "measured_at_enrolment": { "asn": 396982, "as_org": "Google LLC", "country": "US", "region": "Iowa", "city": "Council Bluffs", "network_class": "independent" }, "network_class": "independent" }, "signing": { "kind": "enrolled_ed25519", "key": { "kty": "OKP", "crv": "Ed25519", "x": "gVPOQsBs2oivVLNZjQWwd4XnVNvVfEMN7F3BS3MCPfw" }, "kid": "rCUICgLBrBe1ZbzN1UWC-903F0UjT127xxLKlVxfKIw", "binding": "trust on first use: the id is bound to this key; observations must carry exactly this key and verify under it", "message": "crawlcheck-observation-v1\n + canonical JSON of the envelope" }, "enrolment": { "request": { "kind": "crawlcheck-observer-enrolment", "v": 1, "observer_id": "ind:gcp-session-1", "operator": "CrawlCheck (VSNARY), run from a Claude cloud session", "network": "Google Cloud egress (AS396982), not Cloudflare, not Azure", "contact": "hello@crawlcheck.io", "software": { "name": "crawlcheck-open-observer", "version": "1.0.0" }, "key": { "kty": "OKP", "crv": "Ed25519", "x": "gVPOQsBs2oivVLNZjQWwd4XnVNvVfEMN7F3BS3MCPfw" }, "requested_at": "2026-10-02T04:59:36.207Z" }, "sig": "cK-54xg75IiYhP9184B34FNtGdb2_ri7FPAzs4pqQoXB8kAOAgW5rKNmXigjKhWVTiC3br-AJv5DtDnhlmD_Cg", "message": "crawlcheck-observer-enrol-v1\n + canonical JSON of request" } }, { "observer_id": "ind:gcp-tv-1", "class": "independent", "status": "active", "vetted": false, "enrolled_at": "2026-10-07T13:55:19.860Z", "operator": "CrawlCheck (VSNARY), test vantage run from a Google Cloud container", "software": { "name": "crawlcheck-observer", "version": "1.0.0" }, "network": { "declared": "Google Cloud (AS396982), Columbus US", "measured_at_enrolment": { "asn": 396982, "as_org": "Google LLC", "country": "US", "region": "Iowa", "city": "Council Bluffs", "network_class": "independent" }, "network_class": "independent" }, "signing": { "kind": "enrolled_ed25519", "key": { "kty": "OKP", "crv": "Ed25519", "x": "8DFcVYJ7Xs6kEch0b4s1Wl3QBOZ9xDCDCLo0XFPKDX0" }, "kid": "FflVrsDjtFnli52wcQKvy31qPUuN2q00lmlJQg5kSvo", "binding": "trust on first use: the id is bound to this key; observations must carry exactly this key and verify under it", "message": "crawlcheck-observation-v1\n + canonical JSON of the envelope" }, "enrolment": { "request": { "kind": "crawlcheck-observer-enrolment", "v": 1, "observer_id": "ind:gcp-tv-1", "key": { "kty": "OKP", "crv": "Ed25519", "x": "8DFcVYJ7Xs6kEch0b4s1Wl3QBOZ9xDCDCLo0XFPKDX0" }, "operator": "CrawlCheck (VSNARY), test vantage run from a Google Cloud container", "network": "Google Cloud (AS396982), Columbus US", "software": { "name": "crawlcheck-observer", "version": "1.0.0" }, "requested_at": "2026-10-07T13:55:18.481Z" }, "sig": "5_yfhRDHsXjIJvC3dijg2lVnuG59CiwO7OOsKPnRKmXunYlr1J9dFSiKCE9B4PlvxVxd6A4iZ4DolTIZwco1DA", "message": "crawlcheck-observer-enrol-v1\n + canonical JSON of request" } }, { "observer_id": "ind:vsnary-cloudways-1", "class": "independent", "status": "active", "vetted": false, "enrolled_at": "2026-10-06T19:23:12.325Z", "operator": "VSNARY (operator of crawlcheck.io)", "software": { "name": "crawlcheck-open-observer-php", "version": "1.0.0" }, "network": { "declared": "Cloudways managed hosting: the WordPress server of treeservicedenverllc.com", "measured_at_enrolment": { "asn": 20473, "as_org": "Vultr Holdings, LLC", "country": "US", "region": "California", "city": "Los Angeles", "network_class": "independent" }, "network_class": "independent" }, "signing": { "kind": "enrolled_ed25519", "key": { "kty": "OKP", "crv": "Ed25519", "x": "LzlttGXWuHHOStGtMmD6z-mfrakAYXhcUMMQvl_mtCU" }, "kid": "BNcYAoHlDI7nPPGSlcDJpBlUSPmCpvv4Pw8BAKH_Hbk", "binding": "trust on first use: the id is bound to this key; observations must carry exactly this key and verify under it", "message": "crawlcheck-observation-v1\n + canonical JSON of the envelope" }, "enrolment": { "request": { "kind": "crawlcheck-observer-enrolment", "v": 1, "observer_id": "ind:vsnary-cloudways-1", "operator": "VSNARY (operator of crawlcheck.io)", "network": "Cloudways managed hosting: the WordPress server of treeservicedenverllc.com", "contact": null, "software": { "name": "crawlcheck-open-observer-php", "version": "1.0.0" }, "key": { "kty": "OKP", "crv": "Ed25519", "x": "LzlttGXWuHHOStGtMmD6z-mfrakAYXhcUMMQvl_mtCU" }, "requested_at": "2026-10-06T19:23:11.406Z" }, "sig": "QOL7oNZy4pTNrM_mDLTF8G2HaAsqx5hWbrPO86nyn1v9DjNWeOPiS-2XEtCdV4ZdZVdO1Z4qCRfcZfwPa3PvDg", "message": "crawlcheck-observer-enrol-v1\n + canonical JSON of request" } } ], "protocol": "https://crawlcheck.io/docs/observer-protocol", "enrol": "https://crawlcheck.io/api/observe/enroll", "envelope": { "signature_prefix": "crawlcheck-observation-v1\n", "canonical_json": "keys sorted, no whitespace", "verifier": "https://crawlcheck.io/.well-known/crawlcheck-observers.json" }, "corroboration_statuses": [ "single_observer", "reproduced_same_vantage", "cross_vantage_confirmed", "observer_disagreement", "time_sensitive_divergence" ] }