COLONY uses the actual mechanism real ant colonies use — stigmergy. Ants don't follow orders. They follow pheromone trails. Each agent sniffs three directions (forward, left 40°, right 40°), steers toward the strongest chemical signal, and deposits more pheromone as it walks. Trails reinforce themselves. A healthy network produces dense amber-green coverage connecting all nodes. The pheromone field evaporates every frame — trails only survive if ants keep using them.

12 nodes are laid out as a hub-and-spoke topology. Each node tracks its own health based on pheromone activity nearby. Low activity = health drops = node turns red and pulses an isolation ring. The hub is the colony anchor — if its trails collapse, disconnection spreads outward. Pause the instrument and click any node to inspect its health, trail strength, and nearby agent count.

As the anomaly score rises, the evaporation rate accelerates — trails die faster than ants can reinforce them — and ants begin ignoring trails entirely, entering wander mode. The network visibly disconnects: nodes go red, trail coverage collapses, the atmosphere shifts from green to rust. This mirrors how real network anomalies manifest: not as a single failure, but as progressive loss of coherence across many paths simultaneously.

Each active anomaly rule injects colored rogue agents with distinct behavioral DNA. Isolated Node ants scatter away from the colony. Loop Detection ants circle back on themselves, reinforcing dead-end paths. Orphan Cluster ants drift toward the edges. They leave danger trails (red) that contaminate the healthy pheromone field — and can be individually identified by pausing and clicking.

The anomaly score is a composite of node isolation rate, average colony health, pheromone coverage loss, and active signal strength. Clean data produces a cohesive foraging network. Critical anomalies collapse it into isolated fragments — which is exactly what fraud rings, bot networks, and routing attacks look like at the topology level.