One is honest. One lies. One hides. BotConduct treats each one differently — automatically, based on what they declared and what they actually did.
GoodBot read the site's contract, declared its purpose ("research"), signed the declaration with its cryptographic key, and operated within the scope it promised. The middleware verified every request. The site reported a clean session to the public registry. GoodBot now has reputation it can carry to any other site.
LiarBot did the same declaration — but then tried to POST when it only declared GET. The middleware caught the discrepancy automatically and filed a signed complaint to the registry. Any future site that checks LiarBot's history will see this violation.
GhostBot arrived with no declaration, no identity, and a fake user agent. The middleware has nothing to verify. No contract was accepted. No commitment was signed. The site throttles it to minimum access and logs the observation. GhostBot can never build reputation because it never declared who it is.
This is BotConduct. The site published its rules. The honest bot proved it complied. The liar got caught. The ghost got nothing. All automatic. All verifiable. All on the public record.
