In-placedeceptionconversion
At threshold, swap the reachable world beneath a live session without touching the session.
This is the mechanism the whole system exists for. When risk crosses T, four ordered operations run inside the container that is already there: disconnect backend_net, connect deception_net, unmount /run/secrets, apply default-deny egress.
mgmt_net is not in that list. That single omission is why the SSH session on the attacker's screen does not drop, stutter, or reconnect. PIDs, the process tree, cwd, shell history, environment variables, files they dropped, uptime and /proc all continue because it is the same container. There was never a moment where anything moved.
The alternative, relocating the session to a separate honeypot, was considered and rejected. Relocation leaves fingerprints: a fresh process tree, a reset uptime, a different disk identity, missing history, missing dropped files. Any one of them tells the attacker the environment changed. Continuity is the deception.
- Threshold crossing from L2
- Session case from L3
- deception_net attached
- backend_net detached
- Secrets unmounted
- Egress default-deny
- DECEPTION_CONVERSION event
Rules this layer holds to
Each of these is written down because relaxing it would be locally convenient and globally wrong.
Default-deny egress is not a preference. Letting a deception environment pivot outward to a third party would create real legal liability, so the sealed network is a hard boundary.