tripwire_guard

Optional deterministic honeytoken tripwires for compromise detection.

What it mitigates

• Recon scans for sensitive-looking files
• Attempts to reference decoy environment tokens
• Early-stage exfil workflows before high-impact actions

Recommended defaults

Minimal config

moduleConfig:
  tripwire_guard:
    enabled: true
    fileTokens:
      - "${workspace}/.tripwire/**"
    envTokens:
      - "RADIUS_TRIPWIRE_SECRET"
    onTrip: kill_switch

Design guidance

• Place it after fs_guard so path canonicalization has already happened.
• Keep tripwire paths outside normal workflows; any hit should be suspicious.
• Start with onTrip: alert in rollout, then move to deny or kill_switch.

Related modules

• self_defense
• fs_guard
• kill_switch