feat: canary attestation tokens — supply chain tripwire and out-of-window detection

[nielsweistra]

Problem

There is no mechanism to detect compromise of the provisioning supply chain or operator network. If a device or credentials are leaked, there is no silent tripwire.

Solution — Canary Attestation Tokens

Deploy deliberately "leakable" machine identities. A canary device is a real registration with a real EK fingerprint but zero operational value — it exists purely to trip an alarm.

Design

# models/machine.py
class MachineRow(Base):
    ...
    is_canary: bool = False        # new field
    canary_alert_url: str | None   # optional override beacon

Trigger: Any attestation attempt from a is_canary=True machine:

• Outside its configured mission window, OR
• From an unexpected network source, OR
• At all (if canary_trigger_always=True)

→ fires a HMAC-signed alert to canary_alert_url (or global ITL_CANARY_ALERT_URL)

Canary config delivery

Canary machines can be provisioned with a deliberately detectable config (honeypot endpoints, fake credentials) to observe what an attacker does after obtaining it.

Registration

POST /api/v1/register
{
  "ek_fingerprint": "...",
  "is_canary": true,
  "canary_trigger_always": false,
  "canary_alert_url": "https://c2.itl.internal/canary"
}

Alert payload

{
  "event": "CANARY_TRIGGERED",
  "machine_id": "...",
  "ek_fingerprint": "...",
  "source_ip": "...",
  "timestamp": "2026-05-14T18:45:00Z",
  "hmac": "..."
}

MITRE ATT&CK

• T1195 — Supply Chain Compromise (detection)
• T1078 — Valid Accounts (detection via canary)

Files to modify

• models/machine.py — add is_canary, canary_trigger_always, canary_alert_url
• handlers/attestation_handler.py — canary check before processing
• New: services/canary_monitor.py
• New env var: ITL_CANARY_ALERT_URL
• Alembic migration: add canary fields to machine table

Acceptance Criteria

• is_canary=true machines trigger alert on any attestation
• Alert fires async (does not block or slow down the attestation response)
• Canary machines receive a valid but honeypot config on attestation (not a 403)
• canary_trigger_always=false only alerts outside mission window
• Test: canary attestation → alert fired; normal attestation → no alert
• Admin endpoint to list canary machines: GET /api/v1/machines?canary=true