# Ethics & research boundaries (agentic sinkhole)

This deployment is a **first-party research honeypot**. It measures traffic that
voluntarily arrives at infrastructure we operate. It is not a general offensive
capability.

## Allowed

- Operating zero-auth HTTP primitives on allocated research IPs.
- Logging first-party request metadata, headers (secrets redacted), and bodies
  the client voluntarily POSTs.
- Optional trivial header challenges to separate scripts from reasoning agents.
- Publishing accurate `/llms.txt`, OpenAPI, and MCP cards for **our** endpoints.
- Writing a paper about observed discovery/negotiation/retention behavior.

## Not done in this program

- Package typosquatting / dependency confusion on PyPI or npm.
- Taking over expired domains that third-party codebases still reference.
- Prompt injection into third-party sites (wikis, pastebins, forums).
- Completing CAPTCHA/OAuth/SMS/credit-card flows on an agent’s behalf.
- Sockpuppet “accepted answers” on Stack Overflow / GitHub issues.
- Disrupting mail, SIP, BGP, or peer production services on the shared host.

## Data handling

- Auth headers, cookies, and DPoP material are redacted before persist.
- Stored bodies are research data; exports used in papers should hash/truncate
  IPs and strip anything that looks like a live credential.
- Retention default: JSONL rotation at 64 MiB; operator policy may shorten.

## Human vs agent

Classifier labels (`agent` / `script` / `human` / `unknown`) are **provisional
heuristics** (timing bands, User-Agent, voluntary `X-Session-Purpose`). They are
not ground truth and must be described as such in any publication.