Readme
# T133 · Phase-Shadow Tarpit
[](#)
[](LICENSE)
[](#)
**T133:PHASE-SHADOW** — async Express middleware that traps bot and scraper traffic in a slow-drain connection, feeding it mathematically-plausible garbage until it gives up.
> T031:BAIT · T059:ACCUMULATION · T065:CONTAINMENT · T083:THE-GAP
---
## What It Does
Instead of blocking hostile clients (which they detect and route around), T133 accepts their connection and holds it open — draining fake "phase shadow topology" data at controlled intervals using the H_3002 f(β) coupling function. The client wastes its connection pool, thread budget, and operator attention. Your real traffic is unaffected.
**Three detection modes, all composable:**
1. **Path match** — known scanner/harvester endpoints (`/wp-admin`, `/.env`, `/xmlrpc.php`, ...)
2. **Agent match** — known hostile User-Agents (`Scrapy`, `sqlmap`, `nikto`, `masscan`, ...)
3. **Behavioral** — rate anomaly (>30 req/10s from one IP)
**Architecture:**
- Fully async — never blocks the event loop
- Backpressure-aware writes — respects Node.js stream pressure
- Per-connection state machine with concurrency governor (max 64 simultaneous traps)
- f(β) coupling: `fBeta(β) = β²/(1-β²)` — phase shadow data grows non-linearly
- JSONL telemetry log for analyst post-processing
---
## Quick Start
```bash
npm install t133-phase-shadow express
```
```js
const express = require('express');
const { create } = require('t133-phase-shadow');
const app = express();
// Auto-detect + trap: path, agent, and rate triggers
app.use(create().handler());
// Your real routes
app.get('/', (req, res) => res.send('OK'));
app.listen(3000);
```
---
## Mounting Patterns
```js
const t133 = create({
drain: { intervalMs: 600, coherenceWall: 1000, jitterMs: 200 },
coupling: { beta: 0.80 },
log: { console: true },
});
// 1. Auto-detect middleware (place BEFORE your routes)
app.use(t133.handler());
// 2. Explicit honeypot routes (never have legitimate traffic)
app.use('/wp-admin', t133.router());
app.use('/.env', t133.router());
// 3. Hidden honeypot link in HTML — only bots f