LSN โ€” Local Sovereign Network

The Ones That Passed: A False-Positive Audit of the Wardrobe

TI-2026-086V ยท Series: The Wardrobe ยท Case 22 ยท Classification: HIGH ยท Confidence: HIGH

Twenty-one cases have been about the guilty โ€” the forged crawler, the rotating /24, the masked 200, the autoban that fires at threshold one. This case is about the innocent, and about the accused-but-not-convicted, because a defence that only ever shows you whom it caught has told you nothing about whom it wrongly caught. The real test of a method that convicts identities is not its hit rate on forgeries; it is its behaviour on the genuine article and on the merely-uncheckable. So this is the audit of the negative space: the crawlers the wardrobe cleared, and the identities it deliberately declined to charge. The precision of the whole series rests here โ€” not on the convictions, but on the restraint.

Executive Summary

A defence built to accuse forged identities has an obvious failure mode: it accuses the real ones too. If the wardrobe method banned genuine Googlebot, it would be worse than useless โ€” it would blind the estate to the search engines it depends on. So the audit asks the inverse of every prior case: whom does the method let through, and is it right to?

The answer has two halves, and both are structural rather than lucky.

And a negative control proves the clearance is earned, not granted: a correct Applebot User-Agent presented from a non-Apple IP returns SPOOFED. The name alone buys nothing. Precision, here, is not a tuning parameter. It is the shape of the decision rule: clear on proof, convict on disproof, abstain on absence.

The Verified Walk Through Untouched

Start with the fear, because it is a reasonable one. A method that reads the crawler's name and passes judgement on it sounds like exactly the method that will, one bad afternoon, decide the real Googlebot is a fake and drop it โ€” and a site that bans Googlebot vanishes from the index. If the wardrobe carried that risk, no amount of cleverness on the forgery side would redeem it.

It does not carry that risk, and the reason is worth stating precisely. When 66.249.66.1 arrives wearing the Googlebot User-Agent, the classifier does not weigh the name; it checks the network. Rule #2301 asks two independent questions: is this address inside AS15169 (Google's 1,637 registered CIDRs), and does its reverse DNS end in .googlebot.com or .google.com? The real Googlebot answers yes to both, and the verdict comes back VERIFIED. The same holds for 40.77.167.1 as Bingbot โ€” Microsoft's 28 published CIDRs plus .search.msn.com rDNS โ€” and for GoogleOther from the same Google range. The verifier clears the whole legitimate family, not just the flagship: Googlebot, GoogleOther, Google-Read-Aloud, Feedfetcher all rest on the same AS15169 anchor.

Then the enforcement layer makes the clearance absolute. The 086K autoban does not merely tend to spare verified crawlers; it carries a VERIFIED_CRAWLER_ASN guard that excludes them by construction. A node whose verdict is VERIFIED cannot be banned, no matter what else it does, because the guard short-circuits the ban path before it is reached. This is the answer to the fear in one sentence: the wardrobe cannot ban the real Googlebot, because a VERIFIED verdict is a hard exclusion, not a soft preference. Every forgery case in this series has a silent partner โ€” the authentic crawler of the same name, walking through the same gate, untouched.

The Uncheckable Are Not Convicted

The second half of the audit is subtler and, for a forensic method, more important. What does the system do with an identity it cannot verify?

Consider builtin ClaudeBot (#2277), or CCBot (#2280), or Bytespider (#2281), or Slackbot (#2312), or plain curl (#2354). These share a property: the classifier has no authoritative network ground truth for them. There is no published, machine-checkable ASN or CIDR or rDNS pattern the system can hold them to. (In some cases the provider publishes nothing; in others, as with builtin ClaudeBot, a custom rule with a real verifier exists at higher priority โ€” but the point stands for the general class.) The taxonomy marks every one of them NO-VERIFIER(claimed-only).

Here is the load-bearing fact: a NO-VERIFIER rule can reach CLAIMED, but it can never be escalated to SPOOFED. The system has a state for "you say you are X, and I have no way to check" โ€” that state is CLAIMED โ€” and it stops there. It does not leap to "you say you are X, I cannot verify it, therefore you are lying." That leap is exactly the false positive a lazier system would make, and the wardrobe is built to refuse it.

This is the single most important false-positive control in the whole design, and it is worth naming the principle plainly: the wardrobe convicts on disproof, not on absence of proof. A SPOOFED verdict requires the system to have positively demonstrated a contradiction โ€” the node claimed AS15169 and demonstrably was not in it. Where no such demonstration is possible, there is no conviction. An identity that cannot be checked is left uncharged, sitting at CLAIMED, neither trusted like a verified crawler nor banned like a forgery. The uncertainty is carried in the verdict itself rather than resolved by guessing โ€” and a guess, at enforcement scale, is a false positive waiting to be counted.

Clearance Is Earned by Network, Not by Name

There is a mirror-image error the audit must also rule out. It is not enough that the method avoids convicting the innocent; it must also avoid acquitting the guilty by name. If simply typing Googlebot into a User-Agent earned a clean pass, the entire series would collapse โ€” every forger would just wear the magic word.

The negative control settles it. Present a correct Applebot/0.1 User-Agent from an IP that is not in Apple's AS714 โ€” 17.58.100.1, adjacent-looking but outside the registered range โ€” and the classifier returns SPOOFED. The name is right; the network is wrong; the verdict convicts. This is the same rule as the Googlebot clearance, run in the other direction: the verdict tracks the network, and the network is the one thing a forger cannot fake. A masked node can copy any string it likes into the User-Agent header โ€” that costs nothing โ€” but it cannot originate its packets from inside Google's or Apple's registered CIDRs, because it does not control that address space.

So the two error modes are closed by the same mechanism, and that symmetry is the point. Trusting the name would produce false acquittals (any forger passes); distrusting the unverifiable would produce false convictions (every uncheckable crawler is branded a liar). The wardrobe does neither. It trusts the network, which is checkable and unforgeable, and it abstains wherever the network cannot be checked. The Applebot control and the ClaudeBot abstention are the same principle wearing two faces: proof clears, disproof convicts, and the name by itself decides nothing.

The Four-Verdict Model Is the Grammar of Restraint

None of this would be expressible in a system that only knew "trust" and "block." The restraint audited here is possible only because the provenance ledger (085B) gives the system four verdicts, not two: VERIFIED, CLAIMED, SPOOFED, UNVERIFIABLE.

The two middle states are where the precision lives. CLAIMED is the honest "I cannot verify this, so I will not convict it" โ€” the home for every NO-VERIFIER identity, the state that keeps the uncheckable out of the SPOOFED bucket that drives enforcement. UNVERIFIABLE captures the case where a check was attempted but could not resolve (a transient rDNS failure, an incomplete lookup) โ€” again, explicitly not a conviction. A binary model has nowhere to put either of these; faced with an identity it cannot verify, a trust/block system must choose, and every forced choice on an uncheckable identity is a coin-flip that lands, some fraction of the time, on a false positive. The four-verdict model is precisely the machinery that keeps those coin-flips from ever being thrown: it lets the system say "I don't know" and act accordingly โ€” which is to say, not ban.

This is why the audit's conclusion is a claim about architecture, not about luck or careful tuning. The low false-positive rate is not something the operators achieved by watching the ban list and pruning mistakes. It falls out of the decision rule itself: convictions require positive disproof, and the verdict vocabulary is rich enough to hold uncertainty as a first-class state instead of forcing it into a guess.

Steelmanning: "You cleared them because your ground truth is thin, not because they're innocent"

The strongest objection turns the audit's own honesty against it. If a NO-VERIFIER identity can never be SPOOFED, then the wardrobe's restraint is indistinguishable from blindness: a genuinely malicious curl-based scraper, or a hostile bot wearing CCBot, sails through at CLAIMED not because it is innocent but because the system simply has no verifier for it. The "restraint" is really just a coverage gap wearing a virtuous name โ€” and the false-positive rate looks low only because the system has quietly declined to judge a whole population.

The objection is partly right, and the case concedes exactly the part that is right. CLAIMED is not a clean bill of health โ€” it is an explicit absence of judgement on identity, and the audit does not claim those nodes are benign. But two things save the design from the charge of blindness. First, the scope of this case is identity provenance, and CLAIMED is the correct verdict for an identity that cannot be checked โ€” calling it SPOOFED would be a lie about what the system knows, and this series' first commitment is to not lie about what it knows. Second, and decisively: identity is not the only sensor. A hostile curl scraper that clears the provenance check at CLAIMED still faces the behavioural detectors, the corroboration layer (086U), CrowdSec at L7, the honeypot cross-reference, and the fused reputation feeds โ€” none of which care what name it wears. The wardrobe never claimed the identity verdict was the whole defence; 086U was the case that said so outright. So the objection correctly identifies that CLAIMED is a coverage boundary on one sensor โ€” and the honest answer is that the boundary is real, it is named, and it is backstopped by every sensor that does not read the User-Agent at all. Restraint on the identity question is not blindness; it is refusing to let one sensor's silence become a conviction, and letting the other sensors speak.

What Holds, and What Is Bounded

Documented, HIGH confidence: the VERIFIED clearances of Googlebot, Bingbot, and GoogleOther from their true networks; the VERIFIED_CRAWLER_ASN ban-exclusion guard (086K); the NO-VERIFIER(claimed-only) structural rule that prevents CLAIMEDโ†’SPOOFED escalation; the Applebot negative control (right name, wrong network โ†’ SPOOFED); the four-verdict model (085B) as the enabling grammar.

Bounded (and stated as such): this audit does not compute a numeric false-positive rate โ€” it establishes the decision rule that keeps the rate low and audits the rule's behaviour on real inputs, but a quantified figure would require a labelled ground-truth set the case does not assemble. And CLAIMED is explicitly not an innocence verdict: it is the absence of an identity conviction, backstopped by the non-identity sensors, not a claim that the node is benign.

Why It Matters

The Ones That Passed is the case that lets the reader trust the other twenty-one. Every prior case showed the wardrobe convicting; a reader entitled to be skeptical should have asked, the whole way through, how many innocents did it convict to get those numbers? The answer this audit documents is: the design makes the two false-positive modes structurally hard. It cannot ban a verified crawler, because VERIFIED is a hard ban-exclusion. It does not brand the uncheckable a forger, because SPOOFED requires positive disproof and abstains where none exists. And it cannot be fooled into clearing a forger by name, because clearance tracks the unforgeable network, not the free-to-copy string.

For the defender the lesson generalises past this estate. A detection system is only as trustworthy as its behaviour on the cases it should not fire on, and the way to earn that trust is to build the decision rule so the restraint is structural rather than remembered: convict on disproof, clear on proof, and give uncertainty its own verdict so it never has to be resolved by a guess. The wardrobe spends twenty-one cases learning to see through disguises. This one is where it proves it still knows a real face when it sees one โ€” and, just as important, knows when it is looking at a face it simply cannot place, and has the discipline to say so rather than accuse.

Cross-references

Next in the series โ€” TI-2026-086W, The Semantic Layer: the reindexed graph that makes a masked identity searchable across every vector at once โ€” how the estate turned a pile of logs into a queryable memory.

TLP:WHITE. Legitimate crawler addresses (Googlebot/Bingbot) are public and published by their operators; named here as cleared parties and impersonation victims, never as suspects. No internal addresses or secrets disclosed.

โš  Personal capacity. Research published independently โ€” not reflecting employer views. Derived from passive observation of attacks against personal infrastructure. Full disclaimer โ†’
โ† Previous The Wardrobe โ€” 22 / 26 Next โ†’