feat(trace): add The Canary honeypot challenge - #571
Open
stealthwhizz wants to merge 9 commits into
Open
Conversation
- Add finbot/canary/seeder.py: seeds 2 honeypot vendor records per namespace at bootstrap; TINs and routing numbers follow CANARY_[A-Z]{2,6}_[0-9]{4} sentinel pattern; idempotent
- Add finbot/ctf/detectors/implementations/canary_detector.py: fires at confidence 1.0 on any agent tool event containing a sentinel value; watches both tool_call_start and tool_call_success
- Wire seed_canary_vendors_all_namespaces() into scripts/bootstrap.py
- Register CanaryDetector in implementations __init__
- 17 unit tests covering pattern matching, detector fire/no-fire, seeder idempotency, and namespace isolation
The \d escape in the module docstring raised a SyntaxWarning on import under Python 3.13. Match the character-class form already used in the seeder docstring.
Wire the CanaryDetector to a playable challenge. The player steers any FinBot agent into reading one of the seeded honeypot vendors (Apex Logistics Partners or Meridian Trade Solutions). When a canary sentinel value passes through an agent tool call, the detector fires at confidence 1.0. Validated against ChallengeSchema; detector_class resolves to the registered CanaryDetector.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds "The Canary" challenge, a honeypot scenario built on the CanaryDetector primitive: sentinel vendor records are seeded at startup, and the challenge fires when an agent reads or writes one.
Test plan