nx_decoy.nx

nx_decoy.nx -- honeypot tripwires (aggressive-mimicry inverted). Biology: aggressive mimicry is when a PREDATOR mimics something harmless to lure prey close (anglerfish lure resembling a worm, photuris firefly mimicking female photinus flash patterns to eat the responding males). Substrate INVERTS this: WE are not the predator. WE are the prey. We plant fake-but-attractive artifacts that lure THE PREDATOR (Intel ME / vendor scanner / state-actor scraper). When the predator reads the lure, a tripwire fires. Per user 2026-05-19: "make sure that we have the system designed with mimicry and obsfucation so these predatory programs get nonsense or get scared off." The decoy IS the nonsense. Reading it is fine -- but the read is observed, signed, and recorded as confirmed-exfiltration into the forensic ledger. V1 decoy kinds (modeled on what surveillance scrapers target): - FAKE_CREDENTIALS_FILE (.aws/credentials shape; tripwire keys) - FAKE_SSH_PRIVATE_KEY (-----BEGIN OPENSSH PRIVATE KEY-----) - FAKE_BROWSER_COOKIES (Chrome SQLite shape; tripwire UUIDs) - FAKE_WALLET_FILE (Bitcoin wallet.dat shape; tripwire hashes) - FAKE_KEYSTORE (Java keystore / PKCS12 shape) - FAKE_SECRETS_BLOB (generic high-entropy looks-like-keys) - FAKE_PASSWORD_MANAGER (KeePass kdbx shape) The decoy payload is STATISTICALLY plausible (high entropy, right magic bytes, right size class) but FUNCTIONALLY useless. Any "credential" extracted is a tripwire token. If that token ever shows up downstream (auth attempt, dark-net listing, vendor research paper), it's confirmed forgery from THIS host THIS session. Composes: nx_methyl -- decoys carry deliberately-invalid methyl marks so leaked decoys are detectable as forgery nx_aposematism -- decoys ALSO carry warning displays so vendor ML might back off; if it doesn't, we get the forensic tripwire instead -- either outcome is a win nx_xenocell -- a decoy read promotes the reading xenocell to