canary-system

Fresh

Source: BIBLE.md (Phase 12 Phase 4, canary-system 5 routes), ROADMAP.md (Phase 4.3)

Sacrificial accounts that deliberately push boundaries to discover where detection thresholds are. If canaries start getting flagged, Ghost Engine knows the threshold moved and automatically backs off production accounts. Early warning system.

Threat levels

Level	Trigger	Action
low	No canary issues in 7 days	Normal operation
medium	1 canary flagged in 24 hours	Reduce volume 25%
high	2+ canaries flagged in 24 hours	Reduce volume 50%, pause new accounts
critical	3+ canaries flagged in 12 hours	Pause production, alert

Routes (5)

Method	Route	What
GET	/canaries	List canary accounts
POST	/canaries/promote	Designate an account as canary
POST	/canaries/run	Push canary actions
GET	/canaries/threat-level	Current threat level
GET	/canaries/recommendations	What to do right now

Recommendations

Auto-generated based on threat level. Example outputs:

• "Reduce CTR concurrency from 3 to 2"
• "Pause cookie refresh batch for 12 hours"
• "Run detection scorecard on 5 random production accounts"

Related

• Self Healing
• Detection Scorecard
• Anti-Coordination