Documentation
On error, challenge
If Chitmark is slow or unsure, it returns challenge, never allow.
The API and SDKs surface degraded: true with decision: "challenge" on timeout/error paths. Configure client onDegraded: "challenge" (default). Never auto-allow. Partner apps return HTTP 428; issuing friction uses the challenge endpoint POST /v1/challenge.
We fall back to challenge instead of deny to avoid the high cost of false blocks on real buyers, but it must never be a blind allow.