Proving it

Probes, the Scorecard, and the first-run proof.

What it's for

Isolation you can't verify is just a promise. Umbra ships two proof surfaces that measure the disguise from outside and show you the working: the Scorecard, which reads one Session against a bare machine, and the first proof, the one-screen answer to "is this thing actually working?" that you watch arrive on first run.

The first-proof panel: each row asks the same question of the disguised Session and of the bare machine, with a difference column.
The first proof — every row asked twice, and the difference is the argument.shot-tour · First-proof panel: exit IP, WebRTC and TLS rows, disguised Session vs bare machine, exit 'different'

The Scorecard: what a site could catch

The Scorecard scores an open Session's Fingerprint for self-consistency and lists the weak spots worst-first, each with the one-click fix that closes it — roll a new Fingerprint, assign an exit, or reload.

The engine-level fingerprint

Below JavaScript sits a layer a page reads but scripts can't touch: the TLS and HTTP-2 handshake. The Scorecard measures it for this Account and lays it beside raw Chromium — JA3, JA4, HTTP-2 and exit IP, side by side — so you can see the Account presents a real Chrome network signature distinct from every other. This is opt-in: press Measure.

The Isolation report

The measurement composes into a per-Account report with four checks: the measured exit IP matches the assigned exit (and differs from your real IP), no WebRTC leak, the clock matches the exit region, and the Account's noise seed is unique across your fleet.

Passed / Warning / Leak
A real reading. "Leak" on the WebRTC row means your real IP was seen.
Not measured
Shown as a neutral dash — the check hasn't run. It is never coloured like a pass.

Measured, not guaranteed

The WebRTC leak check is the one to internalise: it can turn a drop red, but only once you've measured.

The first proof

The first-run proof asks every question twice — once of the disguised Session, once of the bare machine — and puts the two answers side by side. Reading across a row is the argument: where a difference should be there (exit IP, the shape of the connection) it says "different"; where sameness would be a leak, it flags it.

See Proofs on drop day for running these probes live across every open Session, and Readiness for how they roll into the go / not-ready verdict.