User Guide

VALIS

Analyst’s Field Guide

See the whole picture.
Prove every line of it.

VALIS turns scattered open-source signals into an auditable intelligence picture — collected, correlated, reasoned over, and packaged for a decision. One workspace, many analysts, working the same problem in real time, online or cut off in the field — and now across many federated headquarters, encrypted in depth — with your own ArcGIS server as the map engine when you have one.

Vast Active Living Intelligence System

Contents

01Building the picture
02Making sense of it
03Reading documents
04Staying honest & unbiased
05Standing watch
06The target package
07Working as a team
08Offline & in the field
09Your own GIS — ArcGIS inside
10Federation — many headquarters, one picture
11Protecting your intelligence
12Agents, export & external systems
13A worked mission, end to end
14Quick reference

01 · Gather

Building the picture

Everything begins with an area of interest and the layers you pull into it. VALIS keeps collection and analysis separate from the feeds themselves, so adding data never means changing code.

Set your area

Type a place, a lat/lon pair, or an MGRS reference into the search box; VALIS resolves it to a bounding box and flies you there. The AOI chip beside the search box shows where you are. This AOI is the lens for everything that follows: collection, analysis, offline bundles, and watches all key off it.

Pull in layers

The Data Layers panel lists every feed your team is granted — aircraft (live ADS-B), vessels (AIS), earthquakes, weather, transit, infrastructure and more, plus any admin-defined feeds. Toggle a layer on and press Collect over your AOI; entities land on the map, graded for reliability, and are shared with your whole team instantly.

Why it matters Your organisation’s proprietary or subscription feeds become first-class VALIS layers in minutes, flowing through the same correlation, fusion and reporting as everything else — and an administrator can define a new feed from a form, no code, with a dry-run test before anything is saved.

02 · Understand

Making sense of it

A map full of dots is data, not intelligence. VALIS’s analysis tools turn what is there into what it means — and every one is deterministic: given the same data it gives the same answer, and it can always show its working. That is what makes the output defensible.

Correlate

Find the connections

Meaningful pairings — close in space, close in time, co-incident — plus density clusters and same-entity candidates.

Movement & reach

Movement and terrain

Track history, reachability, viewsheds and routing turn a position into a projection — on built-in engines, or on your own ArcGIS (ch. 09).

Fusion · I&W

Indications & warnings

Multi-source convergence, severity-ranked and weighted for recency and source reliability.

Information ages — and the map shows it

A track fix from forty minutes ago is not worth the same as one from forty seconds ago, and VALIS treats it that way. Each contact’s confidence decays with age at a rate tuned to its type, and stale entities visibly fade on the map. The underlying record is never altered; you’re simply shown, honestly, how much to trust each mark right now.

03 · Read

Reading documents — who, when & what

Much of intelligence arrives as text — reports, messages, transcripts. VALIS’s Dossier reads a document’s content and pulls out the entities that matter, turning prose into structured, mappable, linkable intelligence: coordinates and grids, people, organisations, dates, money, comms identifiers and case references — each with a confidence score.

Paste text or drop a .txt, .docx or .pdf. Every extraction is highlighted in the source — click any entity and VALIS jumps to it in the text, so you verify each finding in context before trusting it. One button adds everything to the link graph, already connected as a co-occurrence network.

Fully offline, no AI model, no black box

This is the part that matters most, and it is a deliberate design choice. The Dossier runs on deterministic rules, not a machine-learning model — there is nothing to download, no network call, and the same text always yields the same result. That single decision buys you three things a large language model cannot give an intelligence analyst:

Air-gap ready

Works with no connectivity

Because there is no model to host and no service to call, it runs identically inside an air-gapped enclave — exactly where document intelligence is often needed most.

Explainable

Every hit can be justified

Each extraction traces to the rule that found it and the text it came from — not the opaque, unrepeatable output of a model you cannot inspect or defend.

No hallucination

It never invents

A rule engine can only find what is genuinely in the text. It cannot fabricate a name, a grid or a date that was never there — the failure mode that makes LLMs unsafe for evidence.

It is also deliberately precision-biased: it would rather miss a weak candidate than clutter your graph with false ones, so low-confidence catches are clearly marked for your judgement rather than presented as fact. The result is document intelligence you can put in front of a decision-maker and defend line by line — the same standard the rest of VALIS holds itself to.

Not a document store VALIS analyses document content — it does not keep your documents. So findings stay defensible, every analysis records a source reference: the filename, a tamper-evident content fingerprint, and where in the text each entity came from. That reference travels with anything you add to the graph, so you can always prove which document a finding came from — while the original stays in your own records system.

04 · Rigour

Staying honest and unbiased

The hardest part of the job isn’t finding data — it’s not fooling yourself. VALIS builds the discipline of structured analysis into the tool, so your assessment is the product of a method, not a hunch.

ACH

Competing hypotheses

Lay out every plausible explanation side by side, score each piece of evidence against all of them, and let the matrix show which hypothesis the evidence fails to disprove — the opposite of cherry-picking.

Notebook

Chain of reasoning

A timestamped journal on every investigation. Reference entities inline and they auto-link. Chain-of-reasoning beside chain-of-custody.

The AI boundary VALIS can use an AI model to describe a picture you’ve built — a first-draft summary — but the analysis itself is deterministic and the judgement stays yours. No hallucinated facts enter the evidence trail.

05 · Vigilance

Standing watch while you work

You can’t stare at every feed forever. Watchlists and tripwires turn VALIS from something you pull answers from into something that tells you when the situation changes.

Entity watch

Reappearance

Alert when a specific hull, tail number, callsign or named entity reappears — even after going dark.

Geofence

Area entry

Alert when anything — optionally from named sources — enters an area you care about.

Indicator

Severity threshold

Alert when fusion raises a new indicator at or above a severity you set.

Hits arrive live at the alert bell — no polling, no refreshing — shared with your whole team. Acknowledge them, jump to the entity, or fire them onward via a secure webhook.

06 · Decide

The target package

Analysis that stays on your screen helps no one. VALIS assembles your work into a structured intelligence product — an INTSUM model and a briefing deck — that a decision-maker can act on, with the evidence graded and traceable beneath every line.

Every element traces back: an indicator to its contributing entities, an entity to its source and Admiralty grade, an assessment to the notebook entries and ACH matrix behind it. The package carries the proof of why, so the audit trail survives later scrutiny.

Handling & releasability Products and entities carry classification banners and handling caveats. Caveats travel with the data — sharing can never quietly widen a marking — so releasability is preserved as intelligence moves between teams and out to customers.

07 · Together

Working as a team, at the speed of the problem

Intelligence is a team sport, and VALIS is built around that from the ground up. The unit of collaboration is the workspace — a shared compartment where a team sees the same picture, in real time, with strict isolation from other teams.

Live

Shared picture

When any analyst collects, tags or links, it appears on every teammate’s map within moments. No “send me your file.”

Isolation

Compartmented by design

Enforced in the database itself. You only see the workspaces you belong to; another team’s data doesn’t exist from where you sit.

Deconfliction: open any entity and see who on your team has touched it and when — plus a privacy-preserving hint if another team is working the same object, so two desks don’t unknowingly duplicate a target.

Tags and links made by anyone in the workspace appear on your screen — a teammate at the next desk, or an analyst at a partner headquarters on the other side of a federated link. You do not have to reload or ask; the link graph fills in as their work arrives.

08 · Resilience

Offline and in the field

The environments where intelligence matters most are exactly where connectivity fails. VALIS is designed to keep working when the link drops — and to reconcile cleanly when it returns.

Take it offline before you lose signal: your AOI, movement history, your team’s tags, links and investigations, plus the basemap, cache into the browser. Then work as normal — the analysis engines run right in the browser. Sync when you can: one action pushes your work up and pulls teammates’ changes down, idempotently, with clean conflict review.

Two kinds of offline A single analyst can work browser-offline and sync back later; an entire team can also run VALIS inside an air-gapped enclave — the whole stack, multi-user, with no external connectivity at all. The top-bar status reads ENCLAVE so everyone knows the posture.

09 · Your GIS

Your own GIS — ArcGIS inside

Many organisations already run an ESRI ArcGIS server on their own network — with authoritative basemaps, a proper road network, high-resolution elevation and years of internal datasets. VALIS can plug straight into it and use it as the engine behind the map. Nothing to install on your desk: an administrator points VALIS at the server once, and the new capabilities simply light up.

Your maps

Authoritative basemaps

Your organisation’s own cartography — raster or vector — appears in the basemap picker as (local GIS), and joins the automatic by-zoom selection.

Your roads

Real road routing

The Movement tool gains a Road (ArcGIS local) engine: fastest route on your road network, with turn-by-turn directions. Reach gains true drive-time rings with no time cap.

Your terrain

Server-grade viewshed

The Viewshed tool can compute line-of-sight on the server’s own high-resolution elevation model — the same DEM your GIS team certifies.

The GIS Tools panel

A new GIS Tools entry appears in the tool rail whenever a local GIS is connected. It holds the extras: Buffer draws a precise geodesic ring around any point; Profile gives an elevation profile between two points, with climb statistics; Closest ranks the entities already on your map — hospitals, checkpoints, teams — by real road travel time from an incident you pick; Print asks the server to render a full-quality map of your AOI for a report or brief. Every result draws on the map and can be saved to the graph like any other analysis.

Your internal datasets as intelligence layers

Any feature layer published to your GIS — incidents, infrastructure, boundaries, plans — becomes a normal VALIS data layer: collect it over your AOI and it lands on the map graded and inspectable, flowing through the same correlation, fusion, tagging and reporting as every public feed. Your locator joins the search box too, so internal place names resolve first.

Why it matters Because the GIS lives on your own network, all of this works in the air-gapped enclave. A fully disconnected VALIS with a local ArcGIS beside it has authoritative maps, road routing, viewshed, geocoding and your internal datasets — no internet, nothing given up.
Example · Casualty evacuation An incident is reported at a picked point. The analyst opens GIS Tools → Closest with the “medical facilities” layer as candidates: three routes draw on the map, ranked by real drive time on the organisation’s own road network — 12, 19 and 27 minutes. A 5 km buffer marks the cordon, the drive-time rings from Reach show what response can arrive within the hour, and Print renders the map for the incident brief. The site is in an enclave; not one byte left the building.

10 · Federate

Federation — many headquarters, one picture

Everything so far describes one VALIS site. But real intelligence organisations are not one site — they are fleets, coalitions, forward teams and headquarters, spread out and connected by links that are often slow, intermittent, or absent. Federation lets many independent VALIS headquarters (call them VALISHQ1, HQ2, HQ3…) work a problem together as if they were one system, while each remains a complete, self-sufficient VALIS in its own right.

Independent

Every site stands alone

Each headquarters runs the full VALIS and is authoritative for its own work. It never waits on anyone else to let its analysts work.

Converged

One shared picture

Sites exchange only what has changed, so the picture converges across even a poor link — and both sides can prove they now match.

No weak point

Lose a site, carry on

There is no central server whose loss stops the mission. Lose any site — even the primary — and the rest continue undisturbed.

Go dark for weeks — rejoin without losing a thing

A ship sailing out of coverage, a forward team on a dead link, a disconnected enclave — any site can drop off the network entirely for hours, days or weeks and keep working the whole time. This is submarine mode. When it reconnects, VALIS reconciles the divergent pictures with provably no data loss: nothing done in the dark is overwritten or discarded, and where two sites edited the same thing, both versions are preserved for an analyst to judge rather than silently resolved.

The important work comes back first

Bandwidth on a reconnecting link is precious, so VALIS reconciles in priority order: the analyst’s live work — investigations, assessments, watchlists, tags and links — flows first, so shared understanding returns within seconds. Bulk telemetry backfills quietly in the background as capacity allows.

What you see on screen

When your VALIS is federated, a small federation pill appears in the top bar. It answers, at a glance, the three questions you actually have:

Where am I?

Your headquarters

The pill names this site and its role — so with several sites on screen you are never in any doubt which one you are looking at.

Who can I see?

Your peers

How many partner sites are currently reachable. If a link drops, you will see it here first.

Do we agree?

The digest

A fingerprint of your whole workspace. When two sites show the same digest, their pictures are not merely “in sync” — they are provably identical.

When a partner’s work reaches you, VALIS tells you: a notification says “3 changes arrived from VALISHQ1”, the map refreshes, and the new contacts and tags appear in your link graph on their own. You never have to ask for a file, and you never have to wonder whether you have the latest picture — the digest settles it.

You can also press Sync at any time rather than waiting for the scheduler. Syncing both fetches your partners’ work and tells them to come and collect yours, so a change you have just made propagates immediately.

Going dark on purpose

A site can also cut its own link — the Go dark control on the pill. This is not the same as the offline mode described in chapter 08: that caches your browser’s work when you lose signal. Going dark takes the whole headquarters off the federation while it carries on working normally: your analysts keep collecting, tagging and assessing against your own database, and your site simply cannot be reached by partners — nor reach them.

Why you would Emissions control before a transit. A partner you no longer wish to share with in real time. A link you know is compromised. One control, and you are alone — still fully operational, and losing nothing. Restore link brings you back and reconciles in both directions.
Example · A coalition task group Four partner headquarters work a maritime problem across a satellite link that comes and goes. HQ1 acts as the trust anchor; the others sync through it by default but can talk directly if HQ1 is unreachable. A frigate’s HQ goes dark for three days on patrol, its analysts still tagging and assessing contacts throughout. On reconnection, its watchlist hits and assessments reconcile first — the shore team sees them within moments — and the full track history backfills afterwards. Nobody lost a single note.
Sovereignty Each headquarters owns its own store and shares only what it is entitled to share, workspace by workspace. Partners collaborate on the objects that matter without exposing everything — and a site can even relay traffic on behalf of others that it is not itself cleared to read. Federation extends reach without widening trust.

11 · Protection

Protecting your intelligence

Intelligence that moves between sites and sits on machines in the field needs protection at every layer — not one lock, but several, so a single failure never hands an adversary the whole picture. VALIS encrypts in depth.

At rest

Stolen hardware is useless

The datastore, its backups and its logs sit on encrypted volumes. A seized laptop or lifted disk yields ciphertext, not intelligence.

In transit

Sites prove who they are

Links between headquarters are mutually authenticated and encrypted, and every batch of changes is signed by its origin — so a site can prove a change is genuine and untampered.

Per field

Even the database can’t read it

The most sensitive fields are encrypted before they ever reach the database, so a compromised database account sees only ciphertext. Keys never sit beside the data they protect.

Protection that travels with the intelligence

The most important part: encryption doesn’t stop at your fence. Sensitive fields move between federated sites still encrypted, readable only by a site that has been granted the key — and that key is shared over the secure channel so that even a headquarters relaying the traffic in between cannot read it. Keys can be rotated without rewriting a single record, and a partner’s access can be revoked. It is the digital equivalent of a handling caveat that physically enforces itself — releasability preserved not by policy alone, but by mathematics.

Why it matters “Need to know” stops being a promise and becomes a property of the data. A partner site can hold and even forward your intelligence without being able to open the parts it isn’t cleared for — so you can collaborate widely and still sleep at night.

12 · Interoperate

Agents, export & external systems

VALIS isn’t a walled garden. Through the Model Context Protocol, an AI agent can drive VALIS with the same toolset an analyst uses — search, collect, correlate, fuse, tag, link, watch, and assemble an intel summary — and, crucially, an agent is just another analyst: it authenticates and is authorised exactly like a human, confined to its workspaces, gated by the same grants, subject to the same rate limits, and fully audited. No privileged back door.

When the decision lives elsewhere, your workspace picture exports cleanly to STIX 2.1, MISP and KML — carrying only what you’re cleared to see, respecting handling caveats as it leaves, and recorded in the audit trail. A documented REST API serves non-AI integrations over the same authenticated, compartmented channel.

13 · End to end

A worked mission

Here is how the pieces fit on one problem — assess unusual maritime activity in a strait over the last week — from empty map to delivered package, across a federated task group.

01–02 · Frame & gather

Set the AOI, collect

Search the strait, create a workspace, bring in teammates. Toggle vessels, aircraft and org feeds; collect the last seven days, Admiralty-graded and shared live.

03–04 · Watch & correlate

Tripwires, then links

Drop a geofence and a HIGH indicator watch. Run correlation; a proximity-and-time link surfaces a candidate rendezvous. Tag both vessels.

05–06 · Deepen & test

Fusion, imagery, ACH

Movement shows a loiter; fusion raises a HIGH indicator; Cloud Atlas confirms a hull. Build an ACH matrix and log the reasoning.

07–08 · Package & stand watch

Deliver, then keep watching

Generate the INTSUM and deck, apply the caveat, hand it up. Leave the watchlists running for the next shift.

Notice what carried through: a shared picture the team built together, deterministic analysis you can defend, reasoning captured as you went, and a product whose every claim is backed by graded, traceable evidence — produced in an afternoon, resilient to a dropped link, federated across sites, encrypted in depth, and open to automation under supervision.

14 · Reference

Quick reference

The top bar, left to right

Search + AOI

Place / coordinates / MGRS → your area of interest.

Target package

Assemble the INTSUM and briefing deck.

◎ Alert bell

Live watchlist hits for the workspace.

Connection pill

ONLINE / OFFLINE / ENCLAVE, with Take offline, Sync, and — across sites — federation status.

Workspace selector

Switch compartments; your role shown beside each.

⚙ Admin

Users, membership, feed access, the no-code feed builder — and peer enrolment & keys for federation.

The analyst’s loop

Collect → Correlate → Fuse → Test → Package — feeds and docs to the map, find links, raise indicators and warnings, ACH and notebook, then INTSUM and deck.

Remember Nothing you do is a dead end. Every tag, link, note, watch and product is shared with your team, survives a lost connection, converges across every federated site, feeds the target package, and is available to authorised external systems — encrypted in depth, with the audit trail intact the whole way through.
VALIS

Vast Active Living Intelligence System · Analyst’s Field Guide

See the whole picture. Prove every line of it.