# Benign Telemetry Demo Behavior Contract

## Identity

- Source file: `benign-telemetry-demo.ts`
- Classification: source-visible benign executable demonstration
- Purpose: produce harmless local process and file events for defensive telemetry practice
- Inputs: none; any command-line argument causes the program to stop before creating a directory
- Network policy: none; the source imports no network module and performs no name resolution or connection
- Privilege: current non-privileged user only; no elevation request or permission change

## Fixed behavior

When the course preflight passes, the program performs this fixed sequence:

1. Resolve exactly one directory named `coderssecret-malware-defense-demo` below the operating-system temporary directory.
2. Stop if that path already exists, is a link, or cannot be created as a new directory.
3. Create `marker-alpha.txt` with the constant text `CODERSSECRET_TOY_MARKER_ALPHA`.
4. Create `marker-beta.txt` with the constant text `CODERSSECRET_TOY_MARKER_BETA`.
5. Create `synthetic-events.jsonl` containing three fictional course events. Any network identifiers inside the records are documentation-only values; the program does not contact them.
6. Start the current Node.js executable once with the fixed argument `--version`, with no shell, no inherited environment, no input, no detached process, and no output file.
7. Emit a short completion message to standard output.
8. In a `finally` block, remove only the three named files and then remove the now-empty course directory.

The program never recursively deletes a directory. If an unexpected file appears, final directory removal fails closed rather than deleting that file.

## Explicit non-behavior

The program does not:

- accept a path, URL, command, script, plugin, payload, or configuration;
- open a socket, resolve a domain, send a request, or listen on a port;
- read a credential, browser store, token, key, user document, clipboard, input device, or environment variable;
- request elevation, change ownership or permissions, or cross a user boundary;
- add startup entries, services, scheduled tasks, login hooks, extensions, or persistence;
- modify security controls, recovery settings, boot settings, firewall rules, or audit policy;
- encrypt, rename, overwrite, or delete any pre-existing user file;
- download, unpack, load, or execute a second-stage artifact;
- hide, inject into, or alter another process.

## Required isolation

- Use a dedicated disposable course VM restored to the documented clean snapshot.
- Disable every network adapter.
- Disable shared folders, host mounts, clipboard, drag and drop, USB passthrough, cloud sync, and access to real credentials.
- Verify the source SHA-256 in `fixture-manifest.json`.
- Read the complete source and confirm that it matches this contract.
- Use the prerecorded endpoint JSONL instead if any control cannot be proven.

## Stop conditions

Stop before execution when the source hash differs, an argument is required, the fixed temporary path already exists, isolation is incomplete, or a preinstalled approved runtime is unavailable. Stop during execution on a privilege prompt, a network event, access outside the fixed directory, a security-control change, an unexpected child process, an unexpected file, or failure to clean up.

## Teardown evidence

The expected final state is:

- no `marker-alpha.txt`;
- no `marker-beta.txt`;
- no `synthetic-events.jsonl`;
- no `coderssecret-malware-defense-demo` directory;
- no child process remaining;
- no network event;
- only the learner's sanitized written analysis retained.