Analyst’s Field Guide

See the whole picture.
Prove every line of it.

VALIS turns scattered open-source signals into an auditable intelligence picture — collected, correlated, reasoned over, and packaged for a decision. One workspace, many analysts, working the same problem in real time, online or cut off in the field — and now across many federated headquarters, encrypted in depth.

Vast Active Living Intelligence System

01Gather

Building the picture

Everything begins with an area of interest and the layers you pull into it. VALIS keeps collection and analysis separate from the feeds themselves, so adding data never means changing code.

Set your area

Type a place, a lat/lon pair, or an MGRS reference into the search box; VALIS resolves it to a bounding box and flies you there. This AOI is the lens for everything that follows — collection, analysis, offline bundles and watches all key off it.

Pull in layers

The Data Layers panel lists every feed your team is granted — aircraft (live ADS-B), vessels (AIS), earthquakes, weather, transit, infrastructure and more. Toggle a layer and press Collect; entities land on the map, graded for reliability, and shared with your whole team instantly.

02Understand

Making sense of it

A map full of dots is data, not intelligence. VALIS’s analysis tools turn what is there into what it means — and every one is deterministic: given the same data it gives the same answer, and it can always show its working. That is what makes the output defensible.

Find the connections

Meaningful pairings — close in space, close in time, co-incident — plus density clusters and same-entity candidates.

Movement and terrain

Track history, reachability, viewsheds and routing turn a position into a projection.

Indications & warnings

Multi-source convergence, severity-ranked and weighted for recency and source reliability.

Information ages — and the map shows it. Each contact’s confidence decays with age at a rate tuned to its type, and stale entities visibly fade on the map. The underlying record is never altered; you’re simply shown, honestly, how much to trust each mark right now.
03Read

Reading documents — who, when & what

Much of intelligence arrives as text. VALIS’s Dossier reads a document’s content and pulls out the entities that matter — coordinates and grids, people, organisations, dates, money, comms identifiers and case references, each with a confidence score. Paste text or drop a .txt, .docx or .pdf; every extraction is highlighted in the source, so you verify each finding in context before trusting it.

Fully offline · no AI model · no black box
Works with no connectivity

No model to host and no service to call, so it runs identically inside an air-gapped enclave — exactly where document intelligence is often needed most.

Every hit can be justified

Each extraction traces to the rule that found it and the text it came from — not the opaque, unrepeatable output of a model you cannot inspect or defend.

It never invents

A rule engine can only find what is genuinely in the text. It cannot fabricate a name, a grid or a date that was never there — the failure mode that makes LLMs unsafe for evidence.

It is also deliberately precision-biased: it would rather miss a weak candidate than clutter your graph with false ones. The result is document intelligence you can put in front of a decision-maker and defend line by line.

04Rigour

Staying honest and unbiased

The hardest part of the job isn’t finding data — it’s not fooling yourself. VALIS builds the discipline of structured analysis into the tool, so your assessment is the product of a method, not a hunch.

Competing hypotheses

Lay out every plausible explanation side by side, score each piece of evidence against all of them, and let the matrix show which hypothesis the evidence fails to disprove — the opposite of cherry-picking.

Chain of reasoning

A timestamped journal on every investigation. Reference entities inline and they auto-link. Chain-of-reasoning beside chain-of-custody.

05Vigilance

Standing watch while you work

You can’t stare at every feed forever. Watchlists and tripwires turn VALIS from something you pull answers from into something that tells you when the situation changes.

Reappearance

Alert when a specific hull, tail number, callsign or named entity reappears — even after going dark.

Area entry

Alert when anything — optionally from named sources — enters an area you care about.

Severity threshold

Alert when fusion raises a new indicator at or above a severity you set.

Hits arrive live at the alert bell — no polling, no refreshing — shared with your whole team. Acknowledge them, jump to the entity, or fire them onward via a secure webhook.

06Decide

The target package

Analysis that stays on your screen helps no one. VALIS assembles your work into a structured intelligence product — an INTSUM model and a briefing deck — that a decision-maker can act on, with the evidence graded and traceable beneath every line.

Every element traces back. An indicator to its contributing entities, an entity to its source and Admiralty grade, an assessment to the notebook entries and ACH matrix behind it. The package carries the proof of why, so the audit trail survives later scrutiny.
07Together

Working as a team, at the speed of the problem

The unit of collaboration is the workspace — a shared compartment where a team sees the same picture, in real time, with strict isolation from other teams.

Shared picture

When any analyst collects, tags or links, it appears on every teammate’s map within moments. No “send me your file.”

Compartmented by design

Enforced in the database itself. You only see the workspaces you belong to; another team’s data doesn’t exist from where you sit.

Deconfliction: open any entity and see who on your team has touched it and when — plus a privacy-preserving hint if another team is working the same object, so two desks don’t unknowingly duplicate a target.

08Resilience

Offline and in the field

The environments where intelligence matters most are exactly where connectivity fails. VALIS is designed to keep working when the link drops — and to reconcile cleanly when it returns.

Take it offline before you lose signal: your AOI, movement history, your team’s tags, links and investigations, plus the basemap, cache into the browser. Then work as normal — the analysis engines run right in the browser. Sync when you can: one action pushes your work up and pulls teammates’ changes down, idempotently, with clean conflict review.

09Federate

Federation — many headquarters, one picture

Real intelligence organisations are not one site — they are fleets, coalitions, forward teams and headquarters, connected by links that are often slow, intermittent, or absent. Federation lets many independent VALIS headquarters work a problem together as if they were one system, while each remains a complete, self-sufficient VALIS in its own right.

Every site stands alone

Each headquarters runs the full VALIS and is authoritative for its own work. It never waits on anyone else to let its analysts work.

One shared picture

Sites exchange only what has changed, so the picture converges across even a poor link — and both sides can prove they now match.

Lose a site, carry on

There is no central server whose loss stops the mission. Lose any site — even the primary — and the rest continue undisturbed.

Go dark for weeks — rejoin without losing a thing. Any site can drop off the network entirely and keep working — submarine mode. When it reconnects, VALIS reconciles the divergent pictures with provably no data loss, and where two sites edited the same thing both versions are preserved for an analyst to judge rather than silently resolved. The important work comes back first: the analyst’s live thinking flows before bulk telemetry, so shared understanding returns within seconds.

On screen, a small federation pill names your headquarters, shows how many peers are reachable, and displays the digest — a fingerprint of your whole workspace. When two sites show the same digest, their pictures are not merely “in sync” — they are provably identical.

10Protection

Protecting your intelligence

Intelligence that moves between sites and sits on machines in the field needs protection at every layer — not one lock, but several, so a single failure never hands an adversary the whole picture. VALIS encrypts in depth.

Stolen hardware is useless

The datastore, its backups and its logs sit on encrypted volumes. A seized laptop or lifted disk yields ciphertext, not intelligence.

Sites prove who they are

Links between headquarters are mutually authenticated and encrypted, and every batch of changes is signed by its origin — so a site can prove a change is genuine and untampered.

Even the database can’t read it

The most sensitive fields are encrypted before they ever reach the database, so a compromised database account sees only ciphertext. Keys never sit beside the data they protect.

Protection that travels with the intelligence. Sensitive fields move between federated sites still encrypted, readable only by a site granted the key — shared so even a relaying headquarters cannot read it. It is the digital equivalent of a handling caveat that physically enforces itself — releasability preserved not by policy alone, but by mathematics.
11Interoperate

Agents, export & external systems

VALIS isn’t a walled garden. Through the Model Context Protocol, an AI agent can drive VALIS with the same toolset an analyst uses — and, crucially, an agent is just another analyst: it authenticates and is authorised exactly like a human, confined to its workspaces, gated by the same grants, subject to the same rate limits, and fully audited. No privileged back door.

When the decision lives elsewhere, your workspace picture exports cleanly to STIX 2.1, MISP and KML — carrying only what you’re cleared to see, respecting handling caveats as it leaves, and recorded in the audit trail. A documented REST API serves non-AI integrations over the same authenticated, compartmented channel.

12End to end

A worked mission

How the pieces fit on one problem — assess unusual maritime activity in a strait over the last week — from empty map to delivered package, across a federated task group.

Set the AOI, collect

Search the strait, create a workspace, bring in teammates. Toggle vessels, aircraft and org feeds; collect the last seven days, Admiralty-graded and shared live.

Tripwires, then links

Drop a geofence and a HIGH indicator watch. Run correlation; a proximity-and-time link surfaces a candidate rendezvous. Tag both vessels.

Fusion, imagery, ACH

Movement shows a loiter; fusion raises a HIGH indicator; Cloud Atlas confirms a hull. Build an ACH matrix and log the reasoning.

Deliver, then keep watching

Generate the INTSUM and deck, apply the caveat, hand it up. Leave the watchlists running for the next shift.

Notice what carried through: a shared picture the team built together, deterministic analysis you can defend, reasoning captured as you went, and a product whose every claim is backed by graded, traceable evidence — produced in an afternoon, resilient to a dropped link, federated across sites, encrypted in depth, and open to automation under supervision.

13Reference

Quick reference

The top bar, left to right

Place / coordinates / MGRS sets your area of interest. Assemble the INTSUM and briefing deck. Live watchlist hits for the workspace. ONLINE / OFFLINE / ENCLAVE with Take offline, Sync, and — across sites — federation status. Switch compartments, with your role shown beside each. Users, membership, feed access, the no-code feed builder, and peer enrolment & keys for federation.

The analyst’s loop

Collect → Correlate → Fuse → Test → Package — feeds and docs to the map, find links, raise indications and warnings, ACH and notebook, then INTSUM and deck.