ADA-3 fatal headless gate requires unobservable state in unified Chromium

[DouglasBashir]

Summary

ADA-3 v3.0.0 makes headless detection a fatal pass/fail gate across every
anti-detect product. A single wrong verdict makes the complete score zero.
Current unified Chromium product cores can expose identical page environments
in headed and headless modes, so the gate can require miners to infer a
runner-owned state that is not observably different in admissible page JavaScript.

Relevant change

Commit 58345dc4d714e96094db40cb9b06525b33780d00 replaced the previous weighted
headless component with a strict global gate.

Reproduction

Using the public runner contract and the official local APIs, I ran paired
headed/headless cohorts without reading user-agent strings, WebDriver/CDP state,
renderer/device fingerprints, persistent storage, or task-order metadata.

• Octo Browser / Octium 151: 3 headed + 3 headless runs were byte-identical
  across popup creation, move/resize behavior, focus/blur/close, fullscreen
  rejection, Screen Details and permission contracts, and focus/visibility
  event categories.
• GoLogin: 3 headed + 3 headless complete allowed records were identical.
• Multilogin: 3 headed + 3 headless complete allowed records were identical.
• Dolphin Anty: a fresh headed/headless pair was identical across the allowed
  contract probe.
• AdsPower, Dolphin, and Octo launches were independently verified as actually
  headless through their official API response/process state. This was not a
  runner mode-routing failure.
• The full Octo record also collided with normal headed Chrome controls.

Chrome documents that modern Headless creates platform windows without showing
them, otherwise exposes browser functions without limitations, and shares Chrome
code with headful mode:
https://developer.chrome.com/docs/automation-and-testing/headless

Octo's official local API documents and reports its per-profile headless
Boolean:
https://github.com/octobrowser/documentation/blob/main/api/local-client.md

Why common alternatives are not valid

navigator.webdriver, CDP attachment, renderer/WebGL values, hardware/device
attributes, and stable fingerprint aggregation are generic automation or
fingerprinting evidence rather than product-owned artifacts. Focus, visibility,
plugin count, language count, and raw geometry have headed/human collisions.
Inferring mode from deterministic task order, shared storage, URL parameters,
headers, or injected runner metadata would leak the expected answer.

Suggested contract change

Please either document a permitted, causally observable signal that is expected
to distinguish unified Chromium modes across all five product runners, or make
headless accuracy non-fatal.

The smallest backward-looking correction is:

1. keep any detector firing in a human run as a fatal gate;
2. score framework detection independently;
3. restore headless accuracy as a bounded weighted component instead of making
   one false negative zero the complete submission;
4. optionally add an explicit per-product/OS supports_headless capability for
   genuinely unsupported combinations, applied before scheduling rather than
   inferred from missing/failed runs.

I can submit a focused PR with tests once the preferred scoring semantics are
confirmed.

[DouglasBashir]

@aliyuldashev Public production evidence now supports this blocker. At 2026-08-27T19:25:54+03:00, the unauthenticated dashboard for ada_detection_v3 shows 143 total submissions, Average Score 0.0000, and Best Score 0.0000 (dashboard freshness label: Updated 2 min ago). Earlier today, at 112 submissions, the public score fields were still N/A.

The official 3.0.0 image schedules one headed and one headless run for each of the five products, three human runs, and uses the http://challenge_server:10001 origin with shuffled tasks. The five private *-local preset implementations are not present in the public bot-runner repository or image.

Could you please confirm one specific point: does the private runner intentionally create a permitted page-visible, non-UA, non-WebDriver distinction between headed and headless modes? If yes, a sanitized fixture or launch contract is sufficient. If no, the fatal headless gate is not solvable under the published detector policy with unified Chromium.

The all-zero dashboard does not prove every private failure has the same cause, but it shows that no public submission has cleared the current all-or-nothing gates.