# V2 Anti-Tamper Telemetry

V2 anti-tamper telemetry can report detected tampering attempts without crashing
so security can gather intelligence across protected builds. The telemetry layer
does not decide penalties; it produces privacy-safe evidence for manual review
before penalty. The release contract is: report detected tampering attempts
without crashing. manual review before penalty is required.

## Signal Sources

`V2/ue/Build/DRM/v2-anti-tamper-telemetry.json` maps every DRM detection source
to a structured event:

- Executable packing
- Runtime unpacker integrity
- Code virtualization
- Anti-debugging detection
- License verification
- Offline license cache
- Game data integrity

Each source reports detected tampering attempts to `v2.security.drm.anti_tamper`
with event schema `v2.drm.anti_tamper_event.v1`. Report failure never crashes
the process and never weakens the local safe-boot or repair response.

## Privacy And Delivery

Payloads use a privacy-safe payload shape: build id, platform, source, signal
id, severity, timestamp, digest prefix, session nonce, and offline queue state.
Raw account identifiers are forbidden, PII redaction is required, and delivery
uses the canonical `@oshun/event-bus` path documented in
`V2/docs/telemetry/README.md`.

Delivery has rate limiting, retry with backoff, and an encrypted offline queue
for reconnect. Events are gather intelligence only: they can prioritize security
analysis and support triage, but automatic punitive action is blocked until
manual review.

## CI Gates

`V2/ue/Tools/plan-v2-anti-tamper-telemetry.py` emits the deterministic
anti-tamper telemetry plan. `V2/ue/Tools/check-v2-anti-tamper-telemetry.py`
validates the manifest, planner output, detection dependencies, canonical
telemetry/privacy docs, Horde wiring, CI workflow wiring, and this runbook.

Required release gates:

- `drm-anti-tamper-telemetry-plan-generated`
- `drm-anti-tamper-telemetry-source-coverage`
- `drm-anti-tamper-telemetry-non-crashing`
- `drm-anti-tamper-telemetry-privacy-redaction`
- `drm-anti-tamper-telemetry-delivery-guardrails`

The non-crashing gate requires every source to tolerate telemetry delivery
failure, and the delivery guardrail gate requires rate limiting, retry backoff,
and encrypted offline queue coverage.