Start with what the request says
A request can claim to be ChatGPT, Claude or another agent through its user-agent string. That claim is useful for classification, but it is not proof. Any client can copy a token.
illun keeps the observed claim separate from the verification result. Verified means a completed check matched usable vendor evidence. Failed means a completed negative check under that rule’s nonmatch policy. Unavailable means there was no defensible verdict.
Uncertainty is part of the data
Unavailable is not a softer form of verified and failed does not imply malicious intent. Missing client-address evidence, an unsupported method or stale vendor ranges all require an explicit bounded reason instead of a guess.
The dashboard therefore never collapses the three states into one total or a confidence score. Each row retains the evidence that was available when the request was observed.