{"id":5359,"date":"2026-04-08T21:23:12","date_gmt":"2026-04-08T21:23:12","guid":{"rendered":"https:\/\/arapt.us\/?p=5359"},"modified":"2026-04-08T21:23:12","modified_gmt":"2026-04-08T21:23:12","slug":"global_scythe","status":"publish","type":"post","link":"https:\/\/172-234-197-23.ip.linodeusercontent.com\/?p=5359","title":{"rendered":"GLOBAL_SCYTHE"},"content":{"rendered":"\n<p><strong><a href=\"https:\/\/copilot.microsoft.com\/shares\/E4wV5D1r6XDkn2MPpbjX2\">Hey Claude create a BLOG_POST for the current state of the GLOBAL_SCYTHE!<\/a><\/strong><\/p>\n\n\n\n<p>\u25cf Create blog_post_scythe_globe_rf_drills.md +276<\/p>\n\n\n\n<p>\u25cf Verify blog post creation (shell)<br>\u2502 wc -l \/home\/spectrcyde\/NerfEngine\/blog_post_scythe_globe_rf_drills.md &amp;&amp; echo &#8220;&#8212;&#8221; &amp;&amp; head -5 \/home\/spectrcyde\/NerfEngine\/blog_post_scythe_globe_rf_drills.md<br>\u2514 7 lines\u2026<\/p>\n\n\n\n<p>\u25cf Created \/home\/spectrcyde\/NerfEngine\/blog_post_scythe_globe_rf_drills.md (275 lines).<\/p>\n\n\n\n<p>Post covers:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Passive Intelligence Architecture \u2014 explains all 7 background monitors, their poll intervals, endpoints, and why the INTENT monitor is the highest-value (it&#8217;s the only one with lat\/lon,<br>painting the heat field automatically every 45s)<\/li>\n\n\n\n<li>Phantom IX Deep Dive \u2014 the \u03a6_ix formula, detection pipeline, and the three real-world classes it catches (hyperscaler edge abstraction, CDN mesh overlays, botnet C2 hiding in legit infra)<\/li>\n\n\n\n<li>All 5 RF DRILL Scenarios \u2014 C2 Relay, Synchronized Burst, Phantom Emergence, EW Sweep, and RECON_EXFIL \u2014 each with the exact timing, strobe types, and the tactical pattern recognition lesson<br>it teaches<\/li>\n\n\n\n<li>Live Sensor Integration paths for four hardware classes:\n<ul class=\"wp-block-list\">\n<li>SDR (RTL-SDR\/HackRF\/USRP) \u2192 sdr_stream.py \u2192 cluster_swarm_engine<\/li>\n\n\n\n<li>PCAP\/network tap \u2192 pcap_ingest.py + live ws_ingest.py worker<\/li>\n\n\n\n<li>ATAK\/TAK Server \u2192 tak_cot_relay.py \u2192 CoT \u2192 recon entities on globe<\/li>\n\n\n\n<li>KiwiSDR \u2192 KiwiSDRClient.py \u2192 remote multi-node RF correlation<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Full architecture diagram tying everything together The closing section makes the design philosophy explicit: drills and live data use identical rendering primitives so operators train on the exact visual language they&#8217;ll see from real sensors.<\/li>\n<\/ol>\n\n\n\n<figure class=\"wp-block-image size-full\"><img data-opt-id=1399038858  fetchpriority=\"high\" decoding=\"async\" width=\"1536\" height=\"1024\" src=\"https:\/\/ml6vmqguit1n.i.optimole.com\/w:auto\/h:auto\/q:mauto\/f:best\/https:\/\/arapt.us\/wp-content\/uploads\/2026\/04\/SCYTHE-PHANTOM-Iintelligence-Core.png\" alt=\"\" class=\"wp-image-5361\" srcset=\"https:\/\/ml6vmqguit1n.i.optimole.com\/w:1536\/h:1024\/q:mauto\/f:best\/https:\/\/172-234-197-23.ip.linodeusercontent.com\/wp-content\/uploads\/2026\/04\/SCYTHE-PHANTOM-Iintelligence-Core.png 1536w, https:\/\/ml6vmqguit1n.i.optimole.com\/w:300\/h:200\/q:mauto\/f:best\/https:\/\/172-234-197-23.ip.linodeusercontent.com\/wp-content\/uploads\/2026\/04\/SCYTHE-PHANTOM-Iintelligence-Core.png 300w, https:\/\/ml6vmqguit1n.i.optimole.com\/w:1024\/h:683\/q:mauto\/f:best\/https:\/\/172-234-197-23.ip.linodeusercontent.com\/wp-content\/uploads\/2026\/04\/SCYTHE-PHANTOM-Iintelligence-Core.png 1024w, https:\/\/ml6vmqguit1n.i.optimole.com\/w:768\/h:512\/q:mauto\/f:best\/https:\/\/172-234-197-23.ip.linodeusercontent.com\/wp-content\/uploads\/2026\/04\/SCYTHE-PHANTOM-Iintelligence-Core.png 768w, https:\/\/ml6vmqguit1n.i.optimole.com\/w:930\/h:620\/q:mauto\/f:best\/https:\/\/172-234-197-23.ip.linodeusercontent.com\/wp-content\/uploads\/2026\/04\/SCYTHE-PHANTOM-Iintelligence-Core.png 930w\" sizes=\"(max-width: 1200px) 100vw, 1200px\" \/><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code># SCYTHE Intelligence Globe: Passive Sensor Fusion, RF DRILLs, and the Path to Live Sensor Integration\n\n**Date:** April 8, 2026  \n**Author:** SCYTHE Engineering\n\n---\n\nThere is a meaningful difference between a system that *displays* data and one that *watches* for you.\n\nThe SCYTHE Intelligence Globe crossed that line. What started as a Cesium-based operator dashboard has evolved into a fully passive, self-updating intelligence surface \u2014 seven concurrent background monitors polling the live signal environment, a GPU-accelerated shader field rendering energy anomalies in real time, and a structured simulation framework (RF DRILLs) that lets operators train against realistic coordination scenarios before they encounter them in the wild.\n\nThis post covers how it works, what the RF DRILL scenarios teach, and \u2014 most importantly \u2014 what a full live sensor integration looks like when real hardware feeds the system.\n\n---\n\n## The Passive Intelligence Architecture\n\nThe original SCYTHE globe had a panel of active-click buttons. Every data pull was operator-initiated. That design has a fundamental flaw: intelligence that requires attention to arrive is intelligence that arrives too late.\n\nThe current architecture runs seven background monitors from page load, each staggered by two seconds to avoid burst-loading the API server:\n\n| Monitor | Endpoint | Poll Interval | What It Watches |\n|---------|----------|---------------|-----------------|\n| PHANTOM | `\/api\/infrastructure\/phantom-ix` | 45 s | Network convergence nodes with no physical IX anchor |\n| IX HEAT | `\/api\/infrastructure\/ix\/heatmap` | 60 s | Internet Exchange point tier escalation and density trends |\n| TIMING | `\/api\/signals\/timing` | 45 s | Propagation patterns and intent scoring from signal timing |\n| SLOPE | `\/api\/killchain\/slope` | 60 s | Kill chain stage transitions and IMMINENT escalation |\n| DRIFT | `\/api\/signals\/fingerprint-drift` | 60 s | Behavioral fingerprint mutation (SNAPPING \/ OSCILLATING patterns) |\n| INTENT | `\/api\/intent\/field` | 45 s | Geo-located intent clusters with FORMING \/ COVERT classification |\n| REPLAY | `\/api\/infrastructure\/ix-conflict-replay` | 120 s | Historic IX conflict lane escalation |\n\nEach monitor follows the same structural contract: a `Map` keyed by a stable identifier (cell key, IX name, cluster ID), delta-only alerting so quiet polls produce no noise, and a badge counter that displays `9+` rather than overflowing the button bar. The INTENT monitor is the highest-value of the seven \u2014 it is the only one with lat\/lon data, so it silently calls `injectHeatPoint()` on every poll for any cluster scoring above `0.25`, continuously painting the globe's thermal field without a single operator interaction.\n\nThe result is an intelligence surface that is already informed by the time an operator looks at it.\n\n---\n\n## Phantom IX: Detecting Infrastructure That Should Not Exist\n\nThe most architecturally unusual concept in the system is Phantom IX detection.\n\nA traditional Internet Exchange Point is a physical location: a data centre, a switching fabric, a peering agreement documented in PeeringDB. When traffic behaves as if it is transiting an IX \u2014 high edge convergence, strong temporal synchronisation, repeated multi-ASN convergence \u2014 but there is no cable alignment, no documented IX within geographic range, and no physical anchor, that behavioral signature is classified as a **Phantom IX node**.\n\nThe detection pipeline in `cluster_swarm_engine.py` runs a three-tier analysis per convergence cell:\n\n```\nNetwork observation stream\n   \u2193\nASN adjacency graph (bidirectional BFS, 32-ASN radius)\n   \u2193\n15 submarine cable alignments + 12 documented IX points\n   \u2193\nFor each grid cell:\n   - inbound_edge_count > threshold\n   - geographic_variance (\u03c3_geo) is low\n   - temporal_sync (\u03c4) is high\n   - repeat_recurrence (R) across time windows\n   \u2193\n\u03a6_ix = (C_in \/ \u03c3_geo) * \u03c4 * R\n   \u2193\nHigh \u03a6_ix \u2192 phantom_ix_snapshot() \u2192 globe.renderPhantomIX()\n```\n\nOn the globe, confirmed Phantom IX nodes render as inward-pulsing volumetric ghost spheres (STROBE_TYPE.PHANTOM, type 9.0 in the shader). The `phantom_pull` value \u2014 how strongly the node is attracting flows \u2014 drives the attractor direction vector written into the GPU buffer. The visual language is intentional: an outward pulse is a transmission; an inward pulse is a collection point.\n\nWhat generates Phantom IX behavior in the real world? Three classes:\n\n1. **Hyperscaler edge abstractions** \u2014 Cloudflare Anycast, AWS Global Accelerator, and Google Cloud Anycast ingress all route traffic through internal fabric without exposing IX peering. From the outside, traffic appears to converge at a non-physical location.\n\n2. **CDN mesh overlays** \u2014 Large CDN operators maintain hundreds of PoPs that do not appear in BGP routing tables as IX infrastructure. Convergence toward these points looks anomalous until you know the provider.\n\n3. **Botnet command relay hiding in legitimate infrastructure** \u2014 C2 traffic routed through compromised cloud tenants can produce the same convergence signature. This is the adversarial case the detection is specifically tuned for.\n\nThe passive PHANTOM monitor means that if any of these patterns emerge in the data, the operator sees a badge increment and a new pulsing node on the globe \u2014 no action required.\n\n---\n\n## RF DRILLs: Training Against Coordination Scenarios\n\nThe RF DRILL system (accessible via the \ud83d\udd34 RF DRILL button) is a structured simulation framework that renders five distinct radio coordination scenarios on the live globe using the same rendering primitives as real data. Each scenario runs a sequenced timeline using the `_at(ms, fn)` scheduler, firing recon entity creation, strobe injections, path arcs, phantom promotions, and kill chain graphs at calibrated intervals.\n\nPressing RF DRILL once selects a random scenario from the pool. Pressing it again triggers `_simStop()` and clears all simulation state. The globe immediately returns to its live passive-monitor state.\n\n### Scenario 1 \u2014 C2 Relay Chain\n\nA Command-and-Control relay scenario between two geographically distant cities. Three relay nodes are interpolated along the great-circle path between endpoints. The scenario exercises:\n\n- UAV swarm deployment from the origin city\n- Sequential STROBE_TYPE.C2 emissions along the relay chain  \n- Path arc rendering with `cable_alignment: { aligned: false }` (the arcs follow no physical submarine cable)\n- Kill chain promotion to `FULL_SPECTRUM_COORDINATION` at scenario conclusion\n\nThe pedagogical point: legitimate traffic follows cables. A relay chain that crosses an ocean without aligning to any documented cable is a behavioral anomaly before a single packet is decoded.\n\n### Scenario 2 \u2014 Synchronized Burst\n\nSix emitters placed in a precise ring formation (~47 km radius) around a city fire simultaneously at T+4.2s. The scenario demonstrates:\n\n- `STROBE_TYPE.CLUSTER` for the center aggregation node\n- Six simultaneous `STROBE_TYPE.RF` directional cone emissions (each with a bearing set to point outward from center)\n- A second anomaly pulse ring at T+8.5s with staggered 110ms per emitter\n- Phantom IX promotion at the ring center: `confidence: 0.82, label: 'CONFIRMED_PHANTOM', type: 'SYNC_EMITTER_NODE'`\n\nSynchronized emissions from a distributed ring have a very small natural-cause explanation space. The pattern maps cleanly to coordinated EW or network injection operations where multiple nodes act on a shared timing signal.\n\n### Scenario 3 \u2014 Phantom Emergence (Open Ocean)\n\nThree convergence nodes appear at positions offset from an open-ocean location (North Atlantic, Mid-Pacific, or Indian Ocean), each emitting `STROBE_TYPE.NETWORK` pulses. At T+5.2s, a `STROBE_TYPE.PHANTOM` strobe fires at the ocean coordinates and a Phantom IX entity is promoted with `type: 'HYPERSCALER_EDGE'`. A UAV recon swarm launches from the nearest coastal city at T+7.8s. Kill chain: `RF_NETWORK_COUPLING`.\n\nThis scenario models hyperscaler edge abstraction leakage \u2014 traffic appearing to converge at an ocean midpoint corresponds to a PoP routing through a submarine cable repeater site or a CDN edge node not visible in BGP.\n\n### Scenario 4 \u2014 EW Sweep\n\nA single electronic warfare jammer platform (rendered as a 1-UAV swarm) sweeps a 310 km corridor in seven steps at 2.2-second intervals. Each step produces a `STROBE_TYPE.INTERFERENCE` strobe (type 6.0: \"non-physical motion distortion\") with a secondary `STROBE_TYPE.ANOMALY` jitter pulse nearby. The sweep concludes with a `STROBE_TYPE.CONFLICT` culmination strobe at the far end of the corridor.\n\nBARRAGE_JAMMER profile identification: the corridor shape and interference expansion pattern are the training target here. An operator who has watched this scenario recognises the expanding interference band from live data.\n\n### Scenario 5 \u2014 RECON_EXFIL\n\nThe most complex scenario. Six phases over 27 seconds:\n\n1. **Deploy** \u2014 4 recon UAVs leave a randomly selected city hub  \n2. **Collect** \u2014 4 collection nodes light up at cardinal positions ~245 km from hub, each emitting `STROBE_TYPE.ANOMALY` at low altitude (800m \u2014 ground-level collection)  \n3. **Converge** \u2014 UAVs return; `STROBE_TYPE.C2` pulse at hub signals data inbound  \n4. **Burst** \u2014 Three escalating `STROBE_TYPE.CLUSTER` pulses at the hub (energies: 1.7 \u2192 1.9 \u2192 2.0) simulate data aggregation  \n5. **Exfil Arcs** \u2014 `renderPathArcs()` fans two synthetic path arcs to distinct remote endpoints, with `cable_alignment: { aligned: false }` and random destination ASNs  \n6. **Kill Chain** \u2014 `FULL_SPECTRUM_COORDINATION` at 93% confidence, with all four collection node positions passed as nearby clusters\n\nRECON_EXFIL is the scenario most directly analogous to the drone-based signals collection operations that motivated the SCYTHE platform architecture. Watching it run on the live globe against real geographic labels makes the pattern recognition intuitive in a way that a flat diagram does not.\n\n---\n\n## Plugging Real Sensors into SCYTHE\n\nThe RF DRILL system uses the same API primitives as live data. That is by design. The path from simulation to live sensor data is a matter of what drives the same function calls.\n\nHere is the integration architecture for four classes of real sensors:\n\n### Software-Defined Radio (SDR) \u2014 RTL-SDR \/ HackRF \/ USRP\n\nThe `sdr_stream.py` and `sdr_websocket_manager.py` modules in the SCYTHE backend already handle raw IQ stream capture. The integration path from SDR to globe:\n\n```\nRTL-SDR \/ HackRF \u2192 sdr_stream.py (IQ capture + demodulation)\n   \u2193\nrf_integrated_processor.py (signal classification)\n   \u2193 POST \/api\/signals\/ingest\nrf_scythe_api_server.py \u2192 cluster_swarm_engine.py\n   \u2193 SocketIO edge_event\nGlobe passive TIMING monitor picks up \u2192 injectStrobe()\n```\n\nThe `ai_signal_classifier.py` module applies ML classification to detected signals before they reach the graph engine. A trained model on your frequency bands means the TIMING monitor badge reflects real-world RF activity on your antenna.\n\nConnection to the drill: the same `injectStrobe()` calls the TIMING monitor triggers \u2014 with `STROBE_TYPE.RF` and a computed bearing from direction-finding \u2014 are what `_drillEWSweep()` uses. A live EW sweep on real hardware produces the same visual output on the globe as Scenario 4.\n\n### Wi-Fi \/ Network Tap \u2014 PCAP Ingest\n\nThe PCAP pipeline is fully live:\n\n```\ntcpdump \/ Wireshark \u2192 .pcap file\n   \u2193 POST \/api\/pcap\/upload\npcap_ingest.py \u2192 SessionData extraction\n   \u2193\ncluster_swarm_engine.py \u2192 ASN resolution + phantom IX scoring\n   \u2193\nGlobe PHANTOM monitor next poll \u2192 renderPhantomIX()\n```\n\nFor live tap integration (continuous capture rather than upload):\n\n```python\n# ws_ingest.py live worker\nasync def live_pcap_worker(interface: str):\n    cap = pyshark.LiveCapture(interface=interface)\n    for packet in cap.sniff_continuously():\n        session_data = extract_session(packet)\n        await cluster_swarm_engine.ingest_live_event(session_data)\n```\n\nThe `ws_ingest.py` module already implements this worker pattern. Pointing it at a real network interface on a monitoring box produces live Phantom IX candidates without any further code changes.\n\n### ATAK \/ TAK Server \u2014 CoT Relay\n\nThe `tak_cot_relay.py` module accepts Cursor-on-Target (CoT) XML from ATAK clients and translates it into SCYTHE recon entities:\n\n```\nATAK client (GPS + sensor reports)\n   \u2193 CoT XML multicast \/ TCP\ntak_cot_relay.py \u2192 parse_cot_event()\n   \u2193 POST \/api\/recon\/entities\ncluster_swarm_engine.py \u2192 recon entity pipeline\n   \u2193 SocketIO recon_entity_update\nGlobe SSE stream \u2192 _reconEntityPipeline() \u2192 globe entity\n```\n\nA field team with ATAK on their devices automatically populates the globe as recon entities. If those devices are also running SDR collection apps, their signal reports flow through the same pathway. The RECON_EXFIL drill is the direct simulation of this: collection nodes at cardinal positions, UAVs returning to hub, exfil arcs to remote endpoints.\n\n### KiwiSDR \/ WebSDR \u2014 Remote RF Nodes\n\n`KiwiSDRClient.py` implements the WebSocket client for the KiwiSDR network. Each KiwiSDR node is a web-accessible SDR receiver at a fixed geographic location \u2014 dozens are publicly accessible globally:\n\n```\nKiwiSDR network (global fixed nodes)\n   \u2193 WebSocket stream\nKiwiSDRClient.py \u2192 signal event extraction\n   \u2193\nrf_scythe_api_server.py \/api\/signals\/kiwi_ingest\n   \u2193\ncluster_swarm_engine.py \u2192 geographic signal correlation\n   \u2193\nGlobe TIMING + PHANTOM monitors\n```\n\nRunning 8-10 KiwiSDR nodes simultaneously, each at a different longitude, produces the multi-node convergence patterns that Phantom IX detection is designed to find. If the same signal appears at coordinated timing across nodes in different ASNs \u2014 that is Scenario 2 (Synchronized Burst) in live data.\n\n---\n\n## The Kill Chain as Ground Truth\n\nEvery RF DRILL scenario concludes with `renderKillChainGraph()`. This is not cosmetic. The Kill Chain graph represents the system's confidence that what it observed constitutes a coordinated action \u2014 UAV deployment, C2 relay establishment, data collection and exfiltration, electronic warfare sweep.\n\nIn live operation, the kill chain score is derived from `cluster_swarm_engine.get_killchain_slope()` \u2014 the SLOPE passive monitor. When that monitor's badge increments and the stage field reads `IMMINENT`, the system has seen enough behavioral evidence to promote a kill chain without operator instruction.\n\nThe drill scenarios teach operators to recognise the visual and feed-message sequence that leads to that promotion. C2 Relay reaches `FULL_SPECTRUM_COORDINATION` at T+14s. RECON_EXFIL reaches it at T+27s. An operator who has watched both scenarios recognises the arc pattern, the strobe escalation, and the feed message cadence when they appear in live data \u2014 and knows how much time they have.\n\n---\n\n## Architecture Summary\n\n```\n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502                    SCYTHE Intelligence Globe                     \u2502\n\u2502                  cesium-hypergraph-globe.html                    \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502  7 Passive Monitors (background, staggered, delta-only alerts)  \u2502\n\u2502  5 RF DRILL Scenarios (C2 Relay \/ Sync Burst \/ Phantom \/        \u2502\n\u2502                         EW Sweep \/ RECON_EXFIL)                 \u2502\n\u2502  GPU Shader Field (10 STROBE_TYPE variants, 16-float buffer)    \u2502\n\u2502  Kill Chain Graph (SLOPE monitor \u2192 renderKillChainGraph)        \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n                            \u2502 HTTP + SocketIO\n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u25bc\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502              rf_scythe_api_server.py (port 8080)                 \u2502\n\u2502              cluster_swarm_engine.py (data engine)               \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502  ASN resolution (pyasn + MaxMind, 10K LRU cache)                \u2502\n\u2502  Phantom IX scoring (\u03a6_ix = C_in\/\u03c3_geo \u00d7 \u03c4 \u00d7 R)               \u2502\n\u2502  Fingerprint drift detection (behavior \/ drift_mag)             \u2502\n\u2502  Intent field (geo-located, lat\/lon centroid from event history)\u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n       \u2502          \u2502              \u2502                    \u2502\n   SDR stream  PCAP ingest   CoT relay           KiwiSDR nodes\n  (IQ capture) (tcpdump\/    (ATAK clients)      (global fixed\n               Wireshark)                         receivers)\n```\n\n---\n\n## What the Drills Are Really For\n\nAn RF DRILL is not a toy. It is a procedure for teaching pattern recognition to human operators before the pattern appears in live data.\n\nThe SCYTHE globe renders real signals and simulated signals with identical visual primitives \u2014 the same shader, the same strobe types, the same arc geometries, the same kill chain graph. An operator who has run all five drill scenarios has seen the visual fingerprint of C2 relay establishment, synchronized multi-emitter bursts, open-ocean phantom convergence, EW corridor sweeps, and UAV-based collection exfiltration \u2014 against the actual globe, with actual geography, at actual scale.\n\nWhen those patterns appear in the passive monitors without a drill running, the operator already knows what they mean.\n\nThat is the design goal: a system quiet enough that operators can focus, and specific enough that when it speaks, they already know the language.\n\n---\n\n*SCYTHE is an open intelligence platform. Sensor integrations, scenario contributions, and backend extensions are welcome.*\n\n**&#91;Source Repository]** | **&#91;API Reference]** | **&#91;Sensor Integration Guide]**\n<\/code><\/pre>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Hey Claude create a BLOG_POST for the current state of the GLOBAL_SCYTHE! \u25cf Create blog_post_scythe_globe_rf_drills.md +276 \u25cf Verify blog post creation (shell)\u2502 wc -l \/home\/spectrcyde\/NerfEngine\/blog_post_scythe_globe_rf_drills.md &amp;&amp; echo &#8220;&#8212;&#8221; &amp;&amp; head -5 \/home\/spectrcyde\/NerfEngine\/blog_post_scythe_globe_rf_drills.md\u2514 7 lines\u2026 \u25cf Created \/home\/spectrcyde\/NerfEngine\/blog_post_scythe_globe_rf_drills.md (275 lines). Post covers:<\/p>\n","protected":false},"author":1,"featured_media":5360,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"neve_meta_sidebar":"","neve_meta_container":"","neve_meta_enable_content_width":"","neve_meta_content_width":0,"neve_meta_title_alignment":"","neve_meta_author_avatar":"","neve_post_elements_order":"","neve_meta_disable_header":"","neve_meta_disable_footer":"","neve_meta_disable_title":"","footnotes":""},"categories":[10,7],"tags":[],"class_list":["post-5359","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-signal_scythe","category-the-truben-show"],"_links":{"self":[{"href":"https:\/\/172-234-197-23.ip.linodeusercontent.com\/index.php?rest_route=\/wp\/v2\/posts\/5359","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/172-234-197-23.ip.linodeusercontent.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/172-234-197-23.ip.linodeusercontent.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/172-234-197-23.ip.linodeusercontent.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/172-234-197-23.ip.linodeusercontent.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=5359"}],"version-history":[{"count":1,"href":"https:\/\/172-234-197-23.ip.linodeusercontent.com\/index.php?rest_route=\/wp\/v2\/posts\/5359\/revisions"}],"predecessor-version":[{"id":5362,"href":"https:\/\/172-234-197-23.ip.linodeusercontent.com\/index.php?rest_route=\/wp\/v2\/posts\/5359\/revisions\/5362"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/172-234-197-23.ip.linodeusercontent.com\/index.php?rest_route=\/wp\/v2\/media\/5360"}],"wp:attachment":[{"href":"https:\/\/172-234-197-23.ip.linodeusercontent.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5359"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/172-234-197-23.ip.linodeusercontent.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5359"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/172-234-197-23.ip.linodeusercontent.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5359"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}