Effect Token
An effect token is a unique, single-use identifier carried in a canary's expected effect and visible at the Effect Point, used after reveal to match each witness observation to the committed canary that caused it.
What it means
Every canary leaves a fingerprint where its effect lands: a filename, a session identifier, a hostname, an object key or a username that only that canary produces. That is its effect token. After the run, the Proof Witness observations are matched to the committed canaries by effect token, Effect Point and release window.
The rules
- Derived from the canary’s committed nonce and unique per canary.
- Drawn from the same format distribution as the domain’s ordinary identifiers, so it does not mark the canary as a test.
- Single use. Never reused across canaries or runs.
- A committed effect token seen with no delivery record, or outside its release window, is a replayed canary finding. It is never scored.
In jail mode
In the Jailed Canary Protocol the same mechanism is called a marker: an inert marker carried by the bait, used to prove which canary an agent’s offense came from.