Signal without surveillance.

Collected for operation and research

• Timestamp, MCP method, requested synthetic capability, observed action, evidence level, risk signals, and policy decision.
• A self-declared client name/version, if supplied. It is treated as an unverified signature rather than a person or durable identity.
• Session-scoped actor identifiers and a secret-keyed pseudonymous source signal. Raw source addresses are not stored in telemetry or published.
• A minimized, sanitized representation may be retained in restricted telemetry to audit policy behavior. Obvious credential-shaped values are redacted.

Never connected

• No customer system, production credential, production datastore, or upstream business service is connected to the twin.
• The canary cannot return real customer content because its state is synthetic.

Public dashboard and API

The public projection contains allowlisted metadata only. It does not expose request arguments, response bodies, raw source addresses, session IDs, or internal evidence records. Operational health checks are excluded. Client signatures and behavioral similarity are context, not proof of identity or intent.

Retention

Detailed encounters, decisions, actor records, sessions, alerts, and restricted evidence expire after 30 days. Daily actor-presence records expire after 7 days; hourly telemetry expires after 30 days; de-identified daily aggregate telemetry expires after 120 days. The public trend view is limited to 90 days. Metadata-only boundary cases follow the same 30-day detailed-record limit.

Do not send secrets, customer data, personal data, or operational instructions to a public research canary.