The instrument
Every page view on this site is classified at the edge and published to a live stream with the evidence the classification rests on. This page is the part you can try.
Two things about that stream before you start. It shows page views only — assets, /api/* and robots.txt are not records, because one page view drags a dozen subresources behind it. And it opens showing only an assistant acting on behalf of a person; training crawlers, forged claims and ordinary human traffic are one toggle away rather than mixed in.
What this demonstrates. Whether an assistant fetched the site, which surface it came from, and whether that identity is cryptographically proven, circumstantially matched, or merely claimed. Whether a human arrived through an in-app browser. And — the case most tooling gets wrong — that an unverifiable claim is recorded as unverifiable rather than counted.
What it cannot demonstrate. That citation happens. A new property with no inbound links and no index presence will not be surfaced spontaneously by any assistant. Handing an assistant this URL triggers a fetch, which proves detection works when traffic arrives — it proves nothing about whether the property would ever be recommended.
Each one below has been run against this deployment. Open the stream — it opens in a new tab — then work through them.
You have already done this. Your own arrival is in the stream, classified as an ordinary browser session.
The case a sceptical reader will try, and the one most tooling silently counts. Claim to be ChatGPT-User from an address OpenAI does not publish.
curl -s -o /dev/null -A 'Mozilla/5.0 (compatible; ChatGPT-User/1.0; +https://openai.com/bot)' \ https://www.bondi.casa/rooms/harbour-suite
That is a page view, so it appears in the stream — under Show all traffic, since an unproven claim is not AI acting for a person. To read the whole record as JSON, send the same header to /api/whoami, which classifies its caller and returns the record in the response body. It is deliberately not published: it is a diagnostic, not a page view.
curl -s -A 'Mozilla/5.0 (compatible; ChatGPT-User/1.0; +https://openai.com/bot)' \
https://www.bondi.casa/api/whoami | jq '.classification | {actor, identity, metric}'Paste https://www.bondi.casa/rooms/harbour-suite into ChatGPT, Claude, Perplexity or Gemini and ask it to summarise the room. The fetch arrives from the operator's own infrastructure with a declared user-agent.
Ask the app about this property on a phone, then tap through. The app's embedded browser identifies itself in the user-agent.
GPTBot is a training crawler: real, verifiable, and excluded from attribution on purpose, because it carries no user. Run the command and you get the other lesson first.
curl -s -o /dev/null -A 'Mozilla/5.0 (compatible; GPTBot/1.2; +https://openai.com/gptbot)' \ https://www.bondi.casa/journal # and to read the record itself: curl -s -A 'Mozilla/5.0 (compatible; GPTBot/1.2; +https://openai.com/gptbot)' \ https://www.bondi.casa/api/whoami | jq '.classification.purpose, .classification.metric'
To see the exclusion itself, use the GPTBot preset in the simulator below, which supplies an address from inside the published range. It classifies as declared-agent · training · MEASURED · counts as nothing. Measured and excluded are different states: the record does not disbelieve a verified crawler, it declines to count it.
Structurally valid Web Bot Auth headers with nothing behind them.
curl -s https://www.bondi.casa/api/whoami \
-H 'signature-agent: "https://chatgpt.com"' \
-H 'signature-input: sig1=("@authority" "@method" "@path" "signature-agent");created=1;expires=99999999999;keyid="nope";alg="ed25519";tag="web-bot-auth"' \
-H 'signature: sig1=:AAAA:' | jq '.classification.identity, .classification.metric'Check availability, search, and watch the booking-intent record appear. Then look at what the engine received.
The same classifier, run against inputs you type. Useful for the cases you cannot produce from a terminal — an address inside an operator's published range, for instance. Results are not published to the stream.
Range matching is only as good as the list behind it, and the failure runs one way: a stale list silently reclassifies real agents as human. Two dates matter and they are not the same — when we fetched the list, and when the operator last regenerated it. The second is the one that can hurt you.
4 of 9 operator lists are more than 60 days old. Not a bug in this deployment — the operators have not regenerated them. Range matching against a stale list undercounts, so every figure derived from it is a floor.
| Operator | Agents | Prefixes | Operator's list age | Source |
|---|---|---|---|---|
| OpenAI | GPTBot | 21 | 300 days | openai.com/gptbot.json |
| OpenAI | OAI-SearchBot | 35 | 236 days | openai.com/searchbot.json |
| OpenAI | ChatGPT-User | 204 | 12 days | openai.com/chatgpt-user.json |
| Anthropic | ClaudeBot / Claude-User / Claude-SearchBot | 26 | 8 days | claude.com/crawling/bots.json |
| Perplexity | PerplexityBot | 8 | 565 days | www.perplexity.com/perplexitybot.json |
| Perplexity | Perplexity-User | 4 | 313 days | www.perplexity.com/perplexity-user.json |
| Googlebot and common crawlers | 315 | 0 days | developers.google.com/static/crawling/ipranges/common-crawlers.json | |
| Google special crawlers | 270 | 0 days | developers.google.com/static/crawling/ipranges/special-crawlers.json | |
| Google user-triggered fetchers (incl. Google-Agent) | 494 | 0 days | developers.google.com/static/crawling/ipranges/user-triggered-fetchers-google.json |
This signal is deterministic — the string is fixed in an app build, not decided per response by a model — which makes it the strongest human-arrival signal in the design. The obligation that comes with it is a per-app, per-version validation record. Rows below that say provisional have not been confirmed against a live app build here, and any figure derived from them is estimated rather than measured until they are.
| Assistant | Platform | Status | Validated against | Basis |
|---|---|---|---|---|
| ChatGPT | ios | provisional | — | Pattern from third-party reports of the iOS app's embedded browser. NOT confirmed against a live app build here — run the probe from the app to promote this row. |
| Perplexity | any | provisional | — | Pattern from third-party reports. NOT confirmed against a live app build here. |
| Google (Search app / Gemini surfaces) | ios | provisional | — | GSA = Google Search App, the iOS in-app browser. Identifies the Google app, NOT specifically Gemini — an answer surface cannot be inferred from it. |
| Microsoft Copilot | any | provisional | — | Pattern from third-party reports. NOT confirmed against a live app build here. |
The desktop equivalent, and much weaker. Whether a link carries a parameter is a model-side decision that can change overnight with no notice. Every row here is provisional, which is the honest state: this yields a floor, never a count, and it needs a periodic re-verification job so a drop in reported traffic can be told apart from a change in assistant behaviour.
| Assistant | Parameter values watched | Status | Last verified |
|---|---|---|---|
| ChatGPT | chatgpt.com, chatgpt, openai | provisional | never |
| Perplexity | perplexity, perplexity.ai | provisional | never |
| Gemini | gemini, gemini.google.com, bard | provisional | never |
| Copilot | copilot, bing-copilot | provisional | never |
| Claude | claude, claude.ai, anthropic | provisional | never |
Stated plainly, because the alternative is filling these with guesses.
Every known error runs the same direction: we undercount AI. Operators evading declaration, stale range lists, agent-mediated browsing, referral coverage gaps — all of them undercount. The errors compound rather than cancel, which means our figures are a floor. That is the honest direction to err in, and a client should be told rather than left to assume it.