kiosk-reputation

https://github.com/kiosk-hq/kiosk

kiosk-reputation decides *when* and *how hard* to challenge a request with a proof-of-work, issues and verifies the signed challenge, and provides a pluggable reputation policy interface. Pure Ruby — no dependency on any PoW gem or kiosk-core. A PoW backend is registered via Kiosk::Reputation::Backends.register: kiosk-pow-equihash registers itself as "equihash" (the shipped default) in a Rails app; the host registers kiosk-pow-argon2id as the legacy "argon2id" and kiosk-pow-cuckoo as the opt-in "cuckatoo". Anti-DoS invariant: Challenge.verify performs cheap HMAC-sig + expiry checks BEFORE the one expensive backend eval, so floods of forged/expired proofs are rejected without running a proof check. Ships one policy, Policies::RecentSpend: it asks one proof of a session, by a chance that the customer's recent spend lowers.