CANARYDemo

offline capable

Injector

Simulated sensors. Nothing here touches a real mailbox, phone line or breach feed.

Out of scope

· No accounts, no sign-in, no encryption at rest
· Key derived with SHA-256, not Argon2id
· Corpus is seeded; phone lines are simulated
· Deletion requests are generated, never sent
· Hypothesis priors are hand-set, not calibrated