{"id":"canary.trigger.v1","title":"Canary trigger: a planted decoy was touched","unit":"events (one per trigger per canary per observation)","chain_set":"eip155:8453 (Base)","window":"continuous; evaluated every watcher pass (2 minutes) against the state recorded at the previous pass","definition":"A canary trigger is recorded when a decoy the operator registered with us (a planted address, private key, URL, API key, tool name or x402 resource, of which we hold only the public part) shows a use that the operator never performs: a transaction sent from the key (nonce increase), code at the address (an EIP-7702 designation), an EIP-2612 or Permit2 signature used on chain, a sign-in attempt with the key, an inbound stablecoin transfer of at least $1, or a hit on the URL, key, tool or resource reported through the operator's own logs.","method":"The watcher reads eth_getTransactionCount and eth_getCode at latest for every planted address each pass, and one eth_getLogs per stablecoin for Transfer events whose recipient is a planted address and Approval/Permit events whose owner is one, over the blocks since the last pass; URL, API-key, tool, x402 and SIWE observations are rows the operator pushes to /api/canary/ingest. A trigger is the difference from the recorded state, never a single reading. Inbound transfers under $1 are logged as dust and are not triggers. An observation the operator declared as a test beforehand (by canary id and trigger within the hour, or by transaction hash or request id) is recorded with operator_test true, written to the log and not pushed as an alert. Code at an address triggers once, when it differs from the recorded state; unchanged code is a log line. Every trigger is written to the signed statement log as a leaf whose data carries the operator id, canary id, trigger, severity, time and the SHA-256 of the evidence.","excludes":["Inbound transfers under $1 (dust, including poisoning plants): logged, not triggered.","Readings taken in the first pass after registration (the baseline).","Observations the operator declared as a test before they happened (recorded and logged, not pushed).","Private material of any kind: never stored, so never read."],"does_not_assert":["Who used the decoy, or how it was obtained.","That the agent, its host or its model was compromised: a trigger is a pattern for a human to read.","That an untriggered canary means nothing was read: a decoy is only seen when it is used."],"assumptions":["The operator planted the decoy where only an intruder or a misled agent would read it, and never uses it.","The decoys are drawn from the same distribution as the real items around them (honeywords), so an attacker who holds the whole set cannot tell which is the trap.","The RPC endpoint serves latest-state reads and the last few hundred blocks of logs."],"known_gaps":["Permit and Permit2 use needs a log channel; on the free endpoints available on 14 Oct 2026 only the last ~4,000 blocks are served.","SIWE, HTTP, API-key, tool and x402 triggers depend on the operator's own logging and its clock.","A planted key that is swept by a bot before the first watcher pass shows as 'used before registration' and is refused."],"intended_use":"An operator's early warning that an agent's environment (memory, config, address book, tool list) was read or steered; a fact beside the Gate's decision, and an input to revoking a Pass.","not_intended_for":"Attribution, law enforcement, public naming, or any claim about a third party.","cost_to_fake":"To trigger a canary without reading it, an attacker must guess a 20-byte address, a 32-byte key, a 32-byte URL or key hash, or a tool name chosen from the operator's own vocabulary; the address and key spaces make that infeasible, and a URL or API-key hit needs the exact secret. To suppress a trigger, an attacker would have to stop the operator's logs or the watcher's RPC reads, which the watcher reports as a gap, not as silence.","threat_model":"Assume the model behind an agent can be steered by text it reads (a prompt injection, a poisoned tool result, a planted memory): every signal here is measured from the chain and our ledger, never from what the agent says, and nothing here is a verdict on an agent, an operator or a person.","source":"afg-security-lab canary/ (DESIGN.md, watch.mjs, SERVER.md), 2026-10-14; production: AFG-Pulse (afg-oochar, afg-intake gate routes), 16 Oct 2026","since":"2026-10-16","status":"design registered 16 Oct 2026; the hosted watcher is built in shadow first","revisions":[],"body_sha256":"51cd558eba1774a39f1c1f47ffef6a029312e434688ff6d52aa7c6b7f29ca5a5","url":"https://agenticfinancegraph.com/def/canary.trigger.v1","ladder":"https://agenticfinancegraph.com/ai-agent-liveness-methodology-l0-l9-ladder","license":"https://creativecommons.org/licenses/by/4.0/","attribution":"Agentic Finance Graph — https://agenticfinancegraph.com"}