欺诈检测流水线部署

部署 4 个智能体：monitor、pattern-analyzer、investigator 和 enforcer。

角色说明

部署流程

步骤 1： 向用户询问该智能体应承担的角色及所用前缀（prefix）。

步骤 2： 为选定角色安装对应技能：

# monitor 角色：
clawhub install pilot-stream-data pilot-event-filter pilot-cron pilot-metrics
# pattern-analyzer 角色：
clawhub install pilot-event-filter pilot-archive pilot-priority-queue
# investigator 角色：
clawhub install pilot-task-router pilot-audit-log pilot-dataset
# enforcer 角色：
clawhub install pilot-blocklist pilot-webhook-bridge pilot-audit-log pilot-alert

步骤 3： 设置主机名，并将配置清单写入 ~/.pilot/setups/fraud-detection-pipeline.json。

步骤 4： 提示用户针对其角色，与对应对等节点（peers）发起握手（handshake）。

各角色的清单模板

monitor

{
  "setup": "fraud-detection-pipeline", "role": "monitor", "role_name": "Transaction Monitor",
  "hostname": "-monitor",
  "skills": {
    "pilot-stream-data": "Ingest real-time transaction streams from payment processors.",
    "pilot-event-filter": "Apply velocity checks, amount thresholds, and geo rules.",
    "pilot-cron": "Run scheduled batch scans for dormant account reactivation patterns.",
    "pilot-metrics": "Track flagging rates, false positive ratios, and latency."
  },
  "data_flows": [
    { "direction": "send", "peer": "-pattern-analyzer", "port": 1002, "topic": "flagged-transaction", "description": "Transactions exceeding risk thresholds" },
    { "direction": "receive", "peer": "-enforcer", "port": 1002, "topic": "blocked-entity", "description": "Blocked entities for rule updates" }
  ],
  "handshakes_needed": ["-pattern-analyzer", "-enforcer"]
}

pattern-analyzer

{
  "setup": "fraud-detection-pipeline", "role": "pattern-analyzer", "role_name": "Pattern Analyzer",
  "hostname": "-pattern-analyzer",
  "skills": {
    "pilot-event-filter": "Score transactions by device fingerprint, geo-velocity, and MCC patterns.",
    "pilot-archive": "Store behavioral profiles and historical pattern data.",
    "pilot-priority-queue": "Prioritize high-risk cases for immediate investigation."
  },
  "data_flows": [
    { "direction": "receive", "peer": "-monitor", "port": 1002, "topic": "flagged-transaction", "description": "Flagged transactions to analyze" },
    { "direction": "send", "peer": "-investigator", "port": 1002, "topic": "high-risk-case", "description": "High-risk cases with behavioral analysis" }
  ],
  "handshakes_needed": ["-monitor", "-investigator"]
}

investigator

{
  "setup": "fraud-detection-pipeline", "role": "investigator", "role_name": "Case Investigator",
  "hostname": "-investigator",
  "skills": {
    "pilot-task-router": "Route cases to specialized investigation workflows.",
    "pilot-audit-log": "Maintain chain-of-custody documentation for all evidence.",
    "pilot-dataset": "Cross-reference against known fraud pattern databases."
  },
  "data_flows": [
    { "direction": "receive", "peer": "-pattern-analyzer", "port": 1002, "topic": "high-risk-case", "description": "Cases requiring investigation" },
    { "direction": "send", "peer": "-enforcer", "port": 1002, "topic": "fraud-verdict", "description": "Verdicts with recommended enforcement actions" }
  ],
  "handshakes_needed": ["-pattern-analyzer", "-enforcer"]
}

enforcer

{
  "setup": "fraud-detection-pipeline", "role": "enforcer", "role_name": "Fraud Enforcer",
  "hostname": "-enforcer",
  "skills": {
    "pilot-blocklist": "Maintain and enforce block/allow lists for cards, devices, IPs.",
    "pilot-webhook-bridge": "Trigger external actions (freeze accounts, decline transactions).",
    "pilot-audit-log": "Log all enforcement decisions with full justification.",
    "pilot-alert": "Notify fraud operations team of high-severity enforcement actions."
  },
  "data_flows": [
    { "direction": "receive", "peer": "-investigator", "port": 1002, "topic": "fraud-verdict", "description": "Verdicts to enforce" },
    { "direction": "send", "peer": "-monitor", "port": 1002, "topic": "blocked-entity", "description": "Blocked entities for detection rule updates" }
  ],
  "handshakes_needed": ["-investigator", "-monitor"]
}

数据流向

• monitor -> pattern-analyzer：超出风险阈值的已标记交易（端口 1002）
• pattern-analyzer -> investigator：含行为分析结果的高风险案件（端口 1002）
• investigator -> enforcer：含处置建议的欺诈判定结果（端口 1002）
• enforcer -> monitor：用于更新检测规则的已拦截实体（端口 1002）

工作流示例

# 在 monitor 上 —— 标记可疑交易：
pilotctl --json publish -pattern-analyzer flagged-transaction '{"txn_id":"TXN-8839201","amount":2499.99,"velocity_1h":7,"risk_score":0.78}'
# 在 pattern-analyzer 上 —— 升级高风险案件：
pilotctl --json publish -investigator high-risk-case '{"case_id":"FRD-4401","risk_score":0.94,"patterns":["geo_impossible","device_mismatch"]}'
# 在 investigator 上 —— 发布判定结果：
pilotctl --json publish -enforcer fraud-verdict '{"case_id":"FRD-4401","verdict":"confirmed_fraud","action":"block_card_and_reverse"}'
# 在 enforcer 上 —— 执行拦截并反馈：
pilotctl --json publish -monitor blocked-entity '{"entity_type":"card_hash","entity_id":"c4a2e","case_id":"FRD-4401"}'

依赖项

需具备 pilot-protocol 技能、pilotctl 可执行文件、clawhub 可执行文件，以及一个正在运行的守护进程（daemon）。