Analyst’s Field Guide
See the whole picture.
Prove every line of it.
VALIS turns scattered open-source signals into an auditable intelligence picture — collected, correlated, reasoned over, and packaged for a decision. One workspace, many analysts, working the same problem in real time, online or cut off in the field — and now across many federated headquarters, encrypted in depth — with your own ArcGIS server as the map engine when you have one.
Vast Active Living Intelligence System
Contents
01 · Gather
Building the picture
Everything begins with an area of interest and the layers you pull into it. VALIS keeps collection and analysis separate from the feeds themselves, so adding data never means changing code.
Set your area
Type a place, a lat/lon pair, or an MGRS reference into the search box; VALIS resolves it to a bounding box and flies you there. The AOI chip beside the search box shows where you are. This AOI is the lens for everything that follows: collection, analysis, offline bundles, and watches all key off it.
Pull in layers
The Data Layers panel lists every feed your team is granted — aircraft (live ADS-B), vessels (AIS), earthquakes, weather, transit, infrastructure and more, plus any admin-defined feeds. Toggle a layer on and press Collect over your AOI; entities land on the map, graded for reliability, and are shared with your whole team instantly.
02 · Understand
Making sense of it
A map full of dots is data, not intelligence. VALIS’s analysis tools turn what is there into what it means — and every one is deterministic: given the same data it gives the same answer, and it can always show its working. That is what makes the output defensible.
Find the connections
Meaningful pairings — close in space, close in time, co-incident — plus density clusters and same-entity candidates.
Movement and terrain
Track history, reachability, viewsheds and routing turn a position into a projection — on built-in engines, or on your own ArcGIS (ch. 09).
Indications & warnings
Multi-source convergence, severity-ranked and weighted for recency and source reliability.
Information ages — and the map shows it
A track fix from forty minutes ago is not worth the same as one from forty seconds ago, and VALIS treats it that way. Each contact’s confidence decays with age at a rate tuned to its type, and stale entities visibly fade on the map. The underlying record is never altered; you’re simply shown, honestly, how much to trust each mark right now.
03 · Read
Reading documents — who, when & what
Much of intelligence arrives as text — reports, messages, transcripts. VALIS’s Dossier reads a document’s content and pulls out the entities that matter, turning prose into structured, mappable, linkable intelligence: coordinates and grids, people, organisations, dates, money, comms identifiers and case references — each with a confidence score.
Paste text or drop a .txt, .docx or .pdf. Every extraction is highlighted in the source — click any entity and VALIS jumps to it in the text, so you verify each finding in context before trusting it. One button adds everything to the link graph, already connected as a co-occurrence network.
Fully offline, no AI model, no black box
This is the part that matters most, and it is a deliberate design choice. The Dossier runs on deterministic rules, not a machine-learning model — there is nothing to download, no network call, and the same text always yields the same result. That single decision buys you three things a large language model cannot give an intelligence analyst:
Works with no connectivity
Because there is no model to host and no service to call, it runs identically inside an air-gapped enclave — exactly where document intelligence is often needed most.
Every hit can be justified
Each extraction traces to the rule that found it and the text it came from — not the opaque, unrepeatable output of a model you cannot inspect or defend.
It never invents
A rule engine can only find what is genuinely in the text. It cannot fabricate a name, a grid or a date that was never there — the failure mode that makes LLMs unsafe for evidence.
It is also deliberately precision-biased: it would rather miss a weak candidate than clutter your graph with false ones, so low-confidence catches are clearly marked for your judgement rather than presented as fact. The result is document intelligence you can put in front of a decision-maker and defend line by line — the same standard the rest of VALIS holds itself to.
04 · Rigour
Staying honest and unbiased
The hardest part of the job isn’t finding data — it’s not fooling yourself. VALIS builds the discipline of structured analysis into the tool, so your assessment is the product of a method, not a hunch.
Competing hypotheses
Lay out every plausible explanation side by side, score each piece of evidence against all of them, and let the matrix show which hypothesis the evidence fails to disprove — the opposite of cherry-picking.
Chain of reasoning
A timestamped journal on every investigation. Reference entities inline and they auto-link. Chain-of-reasoning beside chain-of-custody.
05 · Vigilance
Standing watch while you work
You can’t stare at every feed forever. Watchlists and tripwires turn VALIS from something you pull answers from into something that tells you when the situation changes.
Reappearance
Alert when a specific hull, tail number, callsign or named entity reappears — even after going dark.
Area entry
Alert when anything — optionally from named sources — enters an area you care about.
Severity threshold
Alert when fusion raises a new indicator at or above a severity you set.
Hits arrive live at the alert bell — no polling, no refreshing — shared with your whole team. Acknowledge them, jump to the entity, or fire them onward via a secure webhook.
06 · Decide
The target package
Analysis that stays on your screen helps no one. VALIS assembles your work into a structured intelligence product — an INTSUM model and a briefing deck — that a decision-maker can act on, with the evidence graded and traceable beneath every line.
Every element traces back: an indicator to its contributing entities, an entity to its source and Admiralty grade, an assessment to the notebook entries and ACH matrix behind it. The package carries the proof of why, so the audit trail survives later scrutiny.
07 · Together
Working as a team, at the speed of the problem
Intelligence is a team sport, and VALIS is built around that from the ground up. The unit of collaboration is the workspace — a shared compartment where a team sees the same picture, in real time, with strict isolation from other teams.
Shared picture
When any analyst collects, tags or links, it appears on every teammate’s map within moments. No “send me your file.”
Compartmented by design
Enforced in the database itself. You only see the workspaces you belong to; another team’s data doesn’t exist from where you sit.
Deconfliction: open any entity and see who on your team has touched it and when — plus a privacy-preserving hint if another team is working the same object, so two desks don’t unknowingly duplicate a target.
Tags and links made by anyone in the workspace appear on your screen — a teammate at the next desk, or an analyst at a partner headquarters on the other side of a federated link. You do not have to reload or ask; the link graph fills in as their work arrives.
08 · Resilience
Offline and in the field
The environments where intelligence matters most are exactly where connectivity fails. VALIS is designed to keep working when the link drops — and to reconcile cleanly when it returns.
Take it offline before you lose signal: your AOI, movement history, your team’s tags, links and investigations, plus the basemap, cache into the browser. Then work as normal — the analysis engines run right in the browser. Sync when you can: one action pushes your work up and pulls teammates’ changes down, idempotently, with clean conflict review.
09 · Your GIS
Your own GIS — ArcGIS inside
Many organisations already run an ESRI ArcGIS server on their own network — with authoritative basemaps, a proper road network, high-resolution elevation and years of internal datasets. VALIS can plug straight into it and use it as the engine behind the map. Nothing to install on your desk: an administrator points VALIS at the server once, and the new capabilities simply light up.
Authoritative basemaps
Your organisation’s own cartography — raster or vector — appears in the basemap picker as (local GIS), and joins the automatic by-zoom selection.
Real road routing
The Movement tool gains a Road (ArcGIS local) engine: fastest route on your road network, with turn-by-turn directions. Reach gains true drive-time rings with no time cap.
Server-grade viewshed
The Viewshed tool can compute line-of-sight on the server’s own high-resolution elevation model — the same DEM your GIS team certifies.
The GIS Tools panel
A new GIS Tools entry appears in the tool rail whenever a local GIS is connected. It holds the extras: Buffer draws a precise geodesic ring around any point; Profile gives an elevation profile between two points, with climb statistics; Closest ranks the entities already on your map — hospitals, checkpoints, teams — by real road travel time from an incident you pick; Print asks the server to render a full-quality map of your AOI for a report or brief. Every result draws on the map and can be saved to the graph like any other analysis.
Your internal datasets as intelligence layers
Any feature layer published to your GIS — incidents, infrastructure, boundaries, plans — becomes a normal VALIS data layer: collect it over your AOI and it lands on the map graded and inspectable, flowing through the same correlation, fusion, tagging and reporting as every public feed. Your locator joins the search box too, so internal place names resolve first.
10 · Federate
Federation — many headquarters, one picture
Everything so far describes one VALIS site. But real intelligence organisations are not one site — they are fleets, coalitions, forward teams and headquarters, spread out and connected by links that are often slow, intermittent, or absent. Federation lets many independent VALIS headquarters (call them VALISHQ1, HQ2, HQ3…) work a problem together as if they were one system, while each remains a complete, self-sufficient VALIS in its own right.
Every site stands alone
Each headquarters runs the full VALIS and is authoritative for its own work. It never waits on anyone else to let its analysts work.
One shared picture
Sites exchange only what has changed, so the picture converges across even a poor link — and both sides can prove they now match.
Lose a site, carry on
There is no central server whose loss stops the mission. Lose any site — even the primary — and the rest continue undisturbed.
Go dark for weeks — rejoin without losing a thing
A ship sailing out of coverage, a forward team on a dead link, a disconnected enclave — any site can drop off the network entirely for hours, days or weeks and keep working the whole time. This is submarine mode. When it reconnects, VALIS reconciles the divergent pictures with provably no data loss: nothing done in the dark is overwritten or discarded, and where two sites edited the same thing, both versions are preserved for an analyst to judge rather than silently resolved.
The important work comes back first
Bandwidth on a reconnecting link is precious, so VALIS reconciles in priority order: the analyst’s live work — investigations, assessments, watchlists, tags and links — flows first, so shared understanding returns within seconds. Bulk telemetry backfills quietly in the background as capacity allows.
What you see on screen
When your VALIS is federated, a small federation pill appears in the top bar. It answers, at a glance, the three questions you actually have:
Your headquarters
The pill names this site and its role — so with several sites on screen you are never in any doubt which one you are looking at.
Your peers
How many partner sites are currently reachable. If a link drops, you will see it here first.
The digest
A fingerprint of your whole workspace. When two sites show the same digest, their pictures are not merely “in sync” — they are provably identical.
When a partner’s work reaches you, VALIS tells you: a notification says “3 changes arrived from VALISHQ1”, the map refreshes, and the new contacts and tags appear in your link graph on their own. You never have to ask for a file, and you never have to wonder whether you have the latest picture — the digest settles it.
You can also press Sync at any time rather than waiting for the scheduler. Syncing both fetches your partners’ work and tells them to come and collect yours, so a change you have just made propagates immediately.
Going dark on purpose
A site can also cut its own link — the Go dark control on the pill. This is not the same as the offline mode described in chapter 08: that caches your browser’s work when you lose signal. Going dark takes the whole headquarters off the federation while it carries on working normally: your analysts keep collecting, tagging and assessing against your own database, and your site simply cannot be reached by partners — nor reach them.
11 · Protection
Protecting your intelligence
Intelligence that moves between sites and sits on machines in the field needs protection at every layer — not one lock, but several, so a single failure never hands an adversary the whole picture. VALIS encrypts in depth.
Stolen hardware is useless
The datastore, its backups and its logs sit on encrypted volumes. A seized laptop or lifted disk yields ciphertext, not intelligence.
Sites prove who they are
Links between headquarters are mutually authenticated and encrypted, and every batch of changes is signed by its origin — so a site can prove a change is genuine and untampered.
Even the database can’t read it
The most sensitive fields are encrypted before they ever reach the database, so a compromised database account sees only ciphertext. Keys never sit beside the data they protect.
Protection that travels with the intelligence
The most important part: encryption doesn’t stop at your fence. Sensitive fields move between federated sites still encrypted, readable only by a site that has been granted the key — and that key is shared over the secure channel so that even a headquarters relaying the traffic in between cannot read it. Keys can be rotated without rewriting a single record, and a partner’s access can be revoked. It is the digital equivalent of a handling caveat that physically enforces itself — releasability preserved not by policy alone, but by mathematics.
12 · Interoperate
Agents, export & external systems
VALIS isn’t a walled garden. Through the Model Context Protocol, an AI agent can drive VALIS with the same toolset an analyst uses — search, collect, correlate, fuse, tag, link, watch, and assemble an intel summary — and, crucially, an agent is just another analyst: it authenticates and is authorised exactly like a human, confined to its workspaces, gated by the same grants, subject to the same rate limits, and fully audited. No privileged back door.
When the decision lives elsewhere, your workspace picture exports cleanly to STIX 2.1, MISP and KML — carrying only what you’re cleared to see, respecting handling caveats as it leaves, and recorded in the audit trail. A documented REST API serves non-AI integrations over the same authenticated, compartmented channel.
13 · End to end
A worked mission
Here is how the pieces fit on one problem — assess unusual maritime activity in a strait over the last week — from empty map to delivered package, across a federated task group.
Set the AOI, collect
Search the strait, create a workspace, bring in teammates. Toggle vessels, aircraft and org feeds; collect the last seven days, Admiralty-graded and shared live.
Tripwires, then links
Drop a geofence and a HIGH indicator watch. Run correlation; a proximity-and-time link surfaces a candidate rendezvous. Tag both vessels.
Fusion, imagery, ACH
Movement shows a loiter; fusion raises a HIGH indicator; Cloud Atlas confirms a hull. Build an ACH matrix and log the reasoning.
Deliver, then keep watching
Generate the INTSUM and deck, apply the caveat, hand it up. Leave the watchlists running for the next shift.
Notice what carried through: a shared picture the team built together, deterministic analysis you can defend, reasoning captured as you went, and a product whose every claim is backed by graded, traceable evidence — produced in an afternoon, resilient to a dropped link, federated across sites, encrypted in depth, and open to automation under supervision.
14 · Reference
Quick reference
The top bar, left to right
Place / coordinates / MGRS → your area of interest.
Assemble the INTSUM and briefing deck.
Live watchlist hits for the workspace.
ONLINE / OFFLINE / ENCLAVE, with Take offline, Sync, and — across sites — federation status.
Switch compartments; your role shown beside each.
Users, membership, feed access, the no-code feed builder — and peer enrolment & keys for federation.
The analyst’s loop
Collect → Correlate → Fuse → Test → Package — feeds and docs to the map, find links, raise indicators and warnings, ACH and notebook, then INTSUM and deck.
Vast Active Living Intelligence System · Analyst’s Field Guide
See the whole picture. Prove every line of it.