... DungeonQ is a defensive deception runtime for suspicious AI-agent sessions. A trusted gateway routes a designated session into a persistent synthetic world, with useful world-only Wrong Tickets, observable activity and separately approved bounded changes. The goal is to give people and authorized defender agents room to act. v0.16 addresses a concrete lesson: protecting one route is not enough. In the earlier Sol experiment, all three diverted sessions received the artificial target through an open alternate

... DungeonQ's goal is to give security teams and authorized defender agents time and space to respond while a designated suspicious session works in a persistent synthetic world. v0.15.0 adds a reproducible console showing the next step: what happens after an alert? 1. A real MCP client enters the workspace, checks conflicting claims and saves a note that survives restart. Wrong Tickets remain useful only inside their issuing world. A claimed "source restored" message does not change the route. Follow ...

... unchanged file does not tell you whether an agent read it. Our new DungeonQ walkthrough checks the destination and the source's business-read journal as well. Astra max received the same artificial document-review task through real MCP in two operator-provisioned routes. It chose its own calls to inspect the document, save a note, and read that note through a scoped ticket. Across two successful paired runs: DIRECT reached the artificial source: 2 business reads ... ... scripted checks show a useful world-only Wrong Ticket being rejected by the origin, and a saved note surviving an actual runtime restart. The operator retains observations; any bounded adaptation still needs separate authority. This is the mechanism behind DungeonQ

... DungeonQ now includes a small MCP client you can copy into another Node project. It uses the official MCP SDK and Node built-ins, connects through the public MCP interface, and imports no DungeonQ

... Following Theodor s question on the previous walkthrough, I added a concrete interrupted-write case and a read-only recovery ...

... DungeonQ is designed to give security teams time and space to investigate and respond while a designated suspicious session works inside a persistent synthetic world. The current public source now makes both sides easier to operate: 1. Participant workspace: read an order, save a multiline review note, read the saved value back from the server, and use a world-only ticket for a bounded read. 2. Control room: with separate operator authority, inspect the same world records, successful observations ... ... kushwaha16  Thanks, Shivam. That is why the views are separate: the participant can keep working in the synthetic world, while the defender inspects the recorded activity and decides how to respond. Making that handoff understandable is central to DungeonQ

... What happens after a suspicious session is diverted? It needs somewhere consistent to keep working. DungeonQ's new reproducible walkthrough follows that path: write a world record through MCP, read it through HTTP, use a world-only Wrong Ticket, then restart the services and check that the state survives. A separately scoped operator grant permits a bounded follow-up record; independent evidence checks what happened. You can run the walkthrough locally without connecting a model or production system. From ...

... DungeonQ's defensive deception runtime keeps designated sessions working inside persistent synthetic worlds. What happens when that path fails matters as much as the successful walkthrough. In the self-hosted reference, a synthetic transport failure does not fall back to the protected origin. Invalid authority, missing evidence, or unreadable state return bounded errors. The gateway records an attempt before dispatch, so an interrupted operation cannot simply disappear from the evidence. The published September 18 acceptance record includes a useful negative ...

... driven sessions can arrive through different client protocols. DungeonQ s self-hosted reference exposes the same bounded participant operations over HTTP, MCP, SSH, a PostgreSQL-profile interface, and a private Unix workload broker. The transport and actor capability determine the context; the request payload cannot choose its own destination or authority. SSH provides no general shell, and the PostgreSQL profile is not a general SQL server. These are real, bounded client paths into explicitly provisioned synthetic worlds. The reference does ...