nx_hr_bot_behavior.nx

nx_hr_bot_behavior.nx -- NISHI HR, visitor module REDESIGNED for PRIVACY + sophistication (operator 2026-06-20: "we are NOT going to log visitors / we don't want IP / we don't want anything; evaluate bots by BEHAVIOR even if they are sophisticated"). SUPERSEDES the UA/IP approach (nx_hr_visitor list-match + nx_hr_visitor_log IP-log), which sophisticated bots defeat (UA spoof + residential-IP rotation) AND which logs PII. This evaluates a visitor purely from EPHEMERAL per-session BEHAVIOR signals -- ZERO IP / UA / identity inputs by construction (privacy by design: nothing about the visitor is stored). Researcher-grounded (sovereign fetch, cited): knowledge/fetched/botbehavior_scraping.raw -- web-scraping countermeasures: CAPTCHA/challenge, fingerprinting, bot-detection, HONEYPOTS (invisible traps humans never touch). [en.wikipedia.org/wiki/Web_scraping] knowledge/fetched/botbehavior_fingerprint.raw -- passive/behavioral fingerprinting signals. [.../Device_fingerprint] knowledge/fetched/botbehavior_bot.raw -- bot taxonomy/threat. [.../Internet_bot] DESIGN: no single signal (a sophisticated bot fakes any one); LAYER them + impose a cost (proof-of-work/JS challenge) -- a bot can spoof a UA but cannot cheaply manufacture real human interaction entropy AND solve a per-session challenge AND stay consistent. Signals are 0..100 (or 0/1), computed live by the front-end and DISCARDED after the verdict. license_tier: ORIGINAL