# Tutorial: Satellites (PLG): canary, AI inject, ITDR, containment

Optional product satellites ship beside the engine/Ops planes. They are
**standalone** CLIs or packages, not required to run Contained/Emulated sensors.

**Time:** ~30-45 minutes  
**Plane:** Satellite PLG (+ optional Ops import)

## Map

| Satellite | Purpose | Tests |
|-----------|---------|-------|
| `satellites/chn-canary` | Canary token generators + playground ROE stub | TDD-305, TDD-330 |
| `satellites/chn-ai` | LangChain / LlamaIndex / FastMCP canary inject | TDD-353 |
| `satellites/chn-itdr-lures` | Agentless GPO/Intune/Jamf/Ansible lure packs + TTL | TDD-380 |
| `satellites/chn-containment-connectors` | EDR/identity connectors; dry-run default; preflight | TDD-381, TDD-382 |

## 1. `chn-canary` generate

```bash
cd satellites/chn-canary
go test ./... -run TDD305 -count=1
go test ./... -run TDD330 -count=1
```

Playground rules of engagement (isolated GTM stub):
[playground-roe.md](../governance/playground-roe.md).

## 2. `chn-ai` inject

```bash
cd satellites/chn-ai
python3 -m pytest tests/ -k tdd353 -q
```

Import emitted canary IDs into Ops inventory when using the Ops plane
(`export_canary_ids_for_ops` helper in the package).

## 3. ITDR lure TTL self-clean

```bash
cd satellites/chn-itdr-lures
go test ./... -run TDD380 -count=1
```

Cryptographic TTL ensures packs self-clean: do not leave durable privileged
lures in production directories without Ops change control.

## 4. Containment connectors (dry-run)

```bash
cd satellites/chn-containment-connectors
go test ./... -run 'TDD381|TDD382' -count=1
```

Defaults: dry-run on, decoy-touch-only triggers, circuit breaker, graduated
modes. Soft/Hard containment is blocked until preflight blast-radius clears.

!!! danger "Never skip preflight"
    Connectors that can touch EDR or identity must remain fail-closed until a
    signed preflight report is clear. Auto-contain from AI scores is forbidden
    (SEC-AG-002 / SEC-AG-003).

## Related

- AI Guardrails: [ai-guardrails-phase2.md](ai-guardrails-phase2.md)
- Phase 3 protection: [phase3-active-protection.md](phase3-active-protection.md)
- Explanation: [safe-agentic-platform.md](../explanation/safe-agentic-platform.md)